SI-6 Security and Privacy Function Verification
Control
a.
Verify the correct operation of [Assignment: organization-defined security and privacy functions];
b.
Perform the verification of the functions specified in SI-6a [Selection (one or more): [to include upon system startup and/or restart] ; upon command by user with appropriate privilege; [at least monthly] ];
c.
Alert [to include system administrators and security personnel] to failed security and privacy verification tests; and
d.
[Selection (one or more): shut the system down; restart the system; [Assignment: organization-defined alternative action(s)] ] when anomalies are discovered.
Discussion
Transitional states for systems include system startup, restart, shutdown, and abort. System notifications include hardware indicator lights, electronic alerts to system administrators, and messages to local computer consoles. In contrast to security function verification, privacy function verification ensures that privacy functions operate as expected and are approved by the senior agency official for privacy or that privacy attributes are applied or used as expected.
FedRAMP-Defined Assignment / Selection Parameters
- SI-6 (b) [Selection: {{ insert: param, si-06_odp.04 }} , upon command by user with appropriate privilege, {{ insert: param, si-06_odp.05 }} ] -
- SI-6 (c) [to include system administrators and security personnel] - personnel or roles to be alerted of failed security and privacy verification tests is/are defined;
- SI-6 (d) [Selection: shut the system down, restart the system, {{ insert: param, si-06_odp.08 }} ] -