+SI-06 Security and Privacy Function Verification
---+SI-06(02) Automation Support for Distributed Testing
---+SI-06(03) Report Verification Results

SI-06 Security and Privacy Function Verification

Control

  1. Verify the correct operation of [Assignement: organization-defined security and privacy functions];
  2. Perform the verification of the functions specified in SI-6a [Selection(one-or-more): {{ insert: param, si-06_odp.04 }} ; upon command by user with appropriate privilege; {{ insert: param, si-06_odp.05 }} ];
  3. Alert [Assignement: personnel or roles] to failed security and privacy verification tests; and
  4. [Selection(one-or-more): shut the system down; restart the system; {{ insert: param, si-06_odp.08 }} ] when anomalies are discovered.

Discussion

Transitional states for systems include system startup, restart, shutdown, and abort. System notifications include hardware indicator lights, electronic alerts to system administrators, and messages to local computer consoles. In contrast to security function verification, privacy function verification ensures that privacy functions operate as expected and are approved by the senior agency official for privacy or that privacy attributes are applied or used as expected.

Assessment Objective

    1. [Assignement: security functions] are verified to be operating correctly;
    2. [Assignement: privacy functions] are verified to be operating correctly;
    1. [Assignement: security functions] are verified [Selection(one-or-more): {{ insert: param, si-06_odp.04 }} ; upon command by user with appropriate privilege; {{ insert: param, si-06_odp.05 }} ];
    2. [Assignement: privacy functions] are verified [Selection(one-or-more): {{ insert: param, si-06_odp.04 }} ; upon command by user with appropriate privilege; {{ insert: param, si-06_odp.05 }} ];
    1. [Assignement: personnel or roles] is/are alerted to failed security verification tests;
    2. [Assignement: personnel or roles] is/are alerted to failed privacy verification tests;
  4. [Selection(one-or-more): shut the system down; restart the system; {{ insert: param, si-06_odp.08 }} ] is/are initiated when anomalies are discovered.

Assessment Method

Examine

System and information integrity policy system and information integrity procedures procedures addressing security and privacy function verification system design documentation system configuration settings and associated documentation alerts/notifications of failed security verification tests list of system transition states requiring security functionality verification system audit records system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with security and privacy function verification responsibilities organizational personnel implementing, operating, and maintaining the system system/network administrators organizational personnel with information security and privacy responsibilities system developer

1. Übersicht

SI-06(02) Automation Support for Distributed Testing

Control

Implement automated mechanisms to support the management of distributed security and privacy function testing.

Discussion

The use of automated mechanisms to support the management of distributed function testing helps to ensure the integrity, timeliness, completeness, and efficacy of such testing.

Assessment Objective

  1. automated mechanisms are implemented to support the management of distributed security function testing;
  2. automated mechanisms are implemented to support the management of distributed privacy function testing.

Assessment Method

Examine

System and information integrity policy system and information integrity procedures procedures addressing security and privacy function verification system design documentation system configuration settings and associated documentation system audit records system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with security and privacy function verification responsibilities organizational personnel implementing, operating, and maintaining the system system/network administrators organizational personnel with information security and privacy responsibilities
SI-06(03) Report Verification Results

Control

Report the results of security and privacy function verification to [Assignement: personnel or roles].

Discussion

Organizational personnel with potential interest in the results of the verification of security and privacy functions include systems security officers, senior agency information security officers, and senior agency officials for privacy.

Assessment Objective

  1. the results of security function verification are reported to [Assignement: personnel or roles];
  2. the results of privacy function verification are reported to [Assignement: personnel or roles].

Assessment Method

Examine

System and information integrity policy system and information integrity procedures procedures addressing security and privacy function verification system design documentation system configuration settings and associated documentation reports of security and privacy function verification results system audit records system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with security and privacy function verification responsibilities organizational personnel who are recipients of security and privacy function verification reports organizational personnel with information security and privacy responsibilities

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
is blocked by SI-06 Security and Privacy Function Verification – Assessment Procedure
is blocked by Control Functionality Verification