SI-06 Security and Privacy Function Verification
System and Information Integrity
Description
a. Verify the correct operation of [Assignment: organization-defined security and privacy functions]; b. Perform the verification of the functions specified in SI-06a [Selection (one or more): [Assignment: organization-defined system transitional states]; upon command by user with appropriate privilege; [Assignment: organization-defined frequency]]; c. Alert [Assignment: organization-defined personnel or roles] to failed security and privacy verification tests; and d. [Selection (one or more): Shut the system down; Restart the system; [Assignment: organization-defined alternative action(s)]] when anomalies are discovered.
Supplemental Guidance
Transitional states for systems include system startup, restart, shutdown, and abort. System notifications include hardware indicator lights, electronic alerts to system administrators, and messages to local computer consoles. In contrast to security function verification, privacy function verification ensures that privacy functions operate as expected and are approved by the senior agency official for privacy or that privacy attributes are applied or used as expected.
Changes from Rev 4
Title changed from 'Security Function Verification' Control text changes 'Notifies' to 'Alert' Parameter adds 'and privacy' Discussion expanded to include privacy function verification
Enhancements (2)
What NIST adds to this control. Select one to read its statement.
SI-06(02) Automation Support for Distributed Testing
Implement automated mechanisms to support the management of distributed security and privacy function testing.
SI-06(03) Report Verification Results
Report the results of security and privacy function verification to [Assignment: organization-defined personnel or roles].
Withdrawn by NIST:
- SI-06(01) Notification of Failed Security Tests, now in SI-06
Patterns that use this control (7)
Grouped by the emphasis each pattern gives it.