# SI-06 Security and Privacy Function Verification

NIST SP 800-53 control. Family: SI System and Information Integrity. Function: detective. Baselines: high. Mapping licence: CC BY-SA 4.0.

Statement: a. Verify the correct operation of [Assignment: organization-defined security and privacy functions]; b. Perform the verification of the functions specified in SI-06a [Selection (one or more): [Assignment: organization-defined system transitional states]; upon command by user with appropriate privilege; [Assignment: organization-defined frequency]]; c. Alert [Assignment: organization-defined personnel or roles] to failed security and privacy verification tests; and d. [Selection (one or more): Shut the system down; Restart the system; [Assignment: organization-defined alternative action(s)]] when anomalies are discovered.
Guidance: Transitional states for systems include system startup, restart, shutdown, and abort. System notifications include hardware indicator lights, electronic alerts to system administrators, and messages to local computer consoles. In contrast to security function verification, privacy function verification ensures that privacy functions operate as expected and are approved by the senior agency official for privacy or that privacy attributes are applied or used as expected.

## Enhancements (2)
- SI-06(02) Automation Support for Distributed Testing
- SI-06(03) Report Verification Results
Withdrawn by NIST: SI-06(01) (now in SI-06).
Each enhancement's statement: /api/v1/controls/SI-06?fields=enhancements

## Patterns that use it (7)
- Important (3): SP-012 Secure Software Development Lifecycle; SP-025 Advanced Monitoring and Detection; SP-050 Mobile Security Architecture (draft)
- Standard (4): SP-001 Client Module; SP-002 Server Module; SP-016 DMZ Module; SP-026 PCI Full Environment

## Clauses by framework (27 frameworks)
- iso_42001_2023: A.6.2.4
- anssi: Hygiene.31, SecNumCloud.13.6
- osfi_b13: B-13.3.3, B-13.3.5
- finma_circular: IV.D(75), IV.D(76)
- gdpr: Art.5(1)(d), Art.32(1)(d)
- dora: Art.10(1), Art.10(2)
- rbi_csf: Annex1.16
- cra: CRA.II.3
- popia: s16
- bcbs_239: Principle 3, Principle 7
- bot_cyber: Ch10.1
- cpmi_pfmi: CG.TE
- eba_ict: 3.4.6
- ecb_croe: CROE.2.6.1
- iosco_cyber: DET-2, DET-4, TEST-3
- cmmc_2: SI
- fips_140: FIPS 140-3 §7.10
- common_criteria: CC Part 2 — FPT
- fca_sysc_13: SYSC 13.7.1, SYSC 13.7.5
- fda_21_cfr_11: §11.10(a), §11.300(e)
- fda_cyber: SA-5
- hitrust_csf: 10.d
- pra_ss1_23: P3.2, P4.3, P5.2
- owasp_masvs_v2: MASVS-RESILIENCE-1
- basel_sco60: SCO60.14, SCO60.21, SCO60.52
- sec_custody_digital: SEC-CD-13
- dpdpa: Rules.6(1)(g)

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/SI-06
- Clauses only: /api/v1/controls/SI-06?fields=mappings
- Page for people: /controls/si-06/