Assessment Objective
Determine if:
- SI-06a.
- SI-06a.[01] [Assignment: security functions] are verified to be operating correctly;
- SI-06a.[02] [Assignment: privacy functions] are verified to be operating correctly;
- SI-06b.
- SI-06b.[01] [Assignment: security functions] are verified [Selection (one or more): [Assignment: system transitional states] ; upon command by user with appropriate privilege; [Assignment: frequency] ];
- SI-06b.[02] [Assignment: privacy functions] are verified [Selection (one or more): [Assignment: system transitional states] ; upon command by user with appropriate privilege; [Assignment: frequency] ];
- SI-06c.
- SI-06c.[01] [Assignment: personnel or roles] is/are alerted to failed security verification tests;
- SI-06c.[02] [Assignment: personnel or roles] is/are alerted to failed privacy verification tests;
- SI-06d. [Selection (one or more): shut the system down; restart the system; [Assignment: alternative action(s)] ] is/are initiated when anomalies are discovered.
Assessment Methods
Examine
- System and information integrity policy
- system and information integrity procedures
- procedures addressing security and privacy function verification
- system design documentation
- system configuration settings and associated documentation
- alerts/notifications of failed security verification tests
- list of system transition states requiring security functionality verification
- system audit records
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with security and privacy function verification responsibilities
- organizational personnel implementing, operating, and maintaining the system
- system/network administrators
- organizational personnel with information security and privacy responsibilities
- system developer
Test
- Organizational processes for security and privacy function verification
- mechanisms supporting and/or implementing the security and privacy function verification capability
Linkede sager
| Linktype | Sag |
|---|---|
| blocks | SI-06 Security and Privacy Function Verification |