SI-11 Error Handling

Control: The information system identifies and handles error conditions in an expeditious manner without providing information that could be exploited by adversaries.

Supplemental Guidance: The structure and content of error messages are carefully considered by the organization. Error messages are revealed only to authorized personnel. Error messages generated by the information system provide timely and useful information without revealing potentially harmful information that could be used by adversaries. Sensitive information (e.g., account numbers, social security numbers, and credit card numbers) are not listed in error logs or associated administrative messages. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.

Control Enhancements: (0) None.

Baseline: LOW Not Selected MOD SI-11 HIGH SI-11

Family: System And Information Integrity

Class: Operational

ISO 17799 mapping: 12.2.1, 12.2.2, 12.2.3, 12.2.4

COBIT 4.1 mapping: AC5

PCI-DSS v2 mapping: None.