SI-6 Security and Privacy Function Verification
Review SI-6
1. Set its parameters
No parameters to set for SI-6.
2. Record its status
a.Verify the correct operation of [Assignment: organization-defined security and privacy functions];
b.Perform the verification of the functions specified in SI-6a [Selection (one-or-more): {{ insert: param, si-06_odp.04 }} ; upon command by user with appropriate privilege; {{ insert: param, si-06_odp.05 }} ];
c.Alert [Assignment: organization-defined personnel or roles] to failed security and privacy verification tests; and
d.[Selection (one-or-more): shut the system down; restart the system; {{ insert: param, si-06_odp.08 }} ] when anomalies are discovered.
Discussion
Transitional states for systems include system startup, restart, shutdown, and abort. System notifications include hardware indicator lights, electronic alerts to system administrators, and messages to local computer consoles. In contrast to security function verification, privacy function verification ensures that privacy functions operate as expected and are approved by the senior agency official for privacy or that privacy attributes are applied or used as expected.
Enhancements
Review SI-6(2)
1. Set its parameters
No parameters to set for SI-6(2).
2. Record its status
Implement automated mechanisms to support the management of distributed security and privacy function testing.
Discussion
The use of automated mechanisms to support the management of distributed function testing helps to ensure the integrity, timeliness, completeness, and efficacy of such testing.
Review SI-6(3)
1. Set its parameters
No parameters to set for SI-6(3).
2. Record its status
Report the results of security and privacy function verification to [Assignment: organization-defined personnel or roles].
Discussion
Organizational personnel with potential interest in the results of the verification of security and privacy functions include systems security officers, senior agency information security officers, and senior agency officials for privacy.
No Enhancements match this Baseline.
ISO/IEC 27001:2022 Crosswalk
No ISO 27001 mapping published for this control.