# SI-13 Predictable Failure Prevention

NIST SP 800-53 control. Family: SI System and Information Integrity. Function: corrective. In no baseline. Mapping licence: CC BY-SA 4.0.

Statement: a. Determine mean time to failure (MTTF) for the following system components in specific environments of operation: [Assignment: organization-defined system components]; and b. Provide substitute system components and a means to exchange active and standby components in accordance with the following criteria: [Assignment: organization-defined MTTF substitution criteria].
Guidance: While MTTF is primarily a reliability issue, predictable failure prevention is intended to address potential failures of system components that provide security capabilities. Failure rates reflect installation-specific consideration rather than the industry-average. Organizations define the criteria for the substitution of system components based on the MTTF value with consideration for the potential harm from component failures. The transfer of responsibilities between active and standby components does not compromise safety, operational readiness, or security capabilities. The preservation of system state variables is also critical to help ensure a successful transfer process. Standby components remain available at all times except for maintenance issues or recovery failures in progress.

## Enhancements (4)
- SI-13(01) Transferring Component Responsibilities
- SI-13(03) Manual Transfer Between Components
- SI-13(04) Standby Component Installation and Notification
- SI-13(05) Failover Capability
Withdrawn by NIST: SI-13(02) (now in SI-07(16)).
Each enhancement's statement: /api/v1/controls/SI-13?fields=enhancements

## Patterns that use it (1)
- Standard (1): SP-034 Cyber Resilience

## Clauses by framework (27 frameworks)
- cobit_2019: BAI04
- nist_csf_2: PR.IR-03
- mas_trm: 7
- bsi_grundschutz: DER.4
- anssi: SecNumCloud.13.3, SecNumCloud.18.1
- finma_circular: IV.A(28), IV.A(29), IV.E(89)
- dora: Art.7(1), Art.9(2)
- rbi_csf: ITGRCA.29
- fisc: FISC.O2, FISC.O13
- hkma_tme1: TME1.5.2, TME1.5.3
- dnb_good_practice: DNB.11.4
- cra: CRA.I.2h
- cbb_tm: TM-5
- cbuae: CR-13
- qatar_nia: BC
- bog_cisd: CISD-BCM
- cbe_csf: OVM-2
- cbn_csf: Part3.7
- sa_js2: JS2-7.5
- bcbs_239: Principle 5
- bot_cyber: Ch4.2
- eba_ict: 3.5(a)
- sebi_cscrf: PR.MA
- fca_sysc_13: SYSC 13.7.2, SYSC 13.8.2
- fda_cyber: SA-6
- solvency_ii: EIOPA-ICT-4.8
- mica: Art.62(5), Art.68(5)
OSA's mapping for nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/SI-13
- Clauses only: /api/v1/controls/SI-13?fields=mappings
- Page for people: /controls/si-13/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.