SI-6 Security Function Verification (M) (H)

NIST 800-53 (r4) Control:

The information system:

a. Verifies the correct operation of [Assignment: organization-defined security functions];

b. Performs this verification [FedRAMP Assignment: (M)(H) to include upon system startup and/or restart at least monthly];

c. Notifies [FedRAMP Assignment: (M)(H) to include system administrators and security personnel] of failed security verification tests; and

d. [Selection (one or more): shuts the information system down; restarts the information system; [FedRAMP Assignment: (M)(H) to include notification of system administrators and security personnel] when anomalies are discovered.

NIST 800-53 (r4) Supplemental Guidance:

Transitional states for information systems include, for example, system startup, restart, shutdown, and abort. Notifications provided by information systems include, for example, electronic alerts to system administrators, messages to local computer consoles, and/or hardware indications such as lights. Related controls: CA-7, CM-6.

References: None.

NIST 800-53 (r5) Discussion:

Transitional states for systems include system startup, restart, shutdown, and abort. System notifications include hardware indicator lights, electronic alerts to system administrators, and messages to local computer consoles. In contrast to security function verification, privacy function verification ensures that privacy functions operate as expected and are approved by the senior agency official for privacy or that privacy attributes are applied or used as expected.

38North Guidance:

Meets Minimum Requirement:

• Verify the correct operation of security functions to confirm their operating effectiveness (e.g., system monitoring, updating, scanning, etc. of VMs, containers, and services). Covered by most modern operating systems, monthly restarts after patching, health monitoring, and audit review (for application and OS failures/crashes). "Health monitoring" is a little bit of both general ops health and security health. The security function typically aligns to the OS checks that are performed at startup and the logs showing any failures. Mentioning compliance scanning will help and should be included in the SSP, but should also include language that the system utilizes modern operating systems that perform self checks upon startup and shutdown along with ConMon auditing for any anomalous events. If the CSP has any automated health checks that identify CPU spikes, kernel crashes, shutdowns, etc. that should be included as well.

• Perform this verification upon system startup and/or restart at least monthly.

• Notify designated personnel to include system administrators and security personnel of failed security verification tests.

• Shut down and/or restart the information system and automatically notify system administrators and security personnel when anomalies are discovered.

Best Practice: None

Unofficial FedRAMP Guidance: None

Assessment Evidence:

• Configuration showing how verification of security functionality is performed.

• List of system transition states (e.g., system startup, restart, shutdown, and abort) requiring security functionality verification, configuration showing when and how often verification of security functionality is performed (e.g., at least weekly, monthly, etc.).

• Alert notifications of failed security verification tests.

• Configuration showing what actions are taken (shut down and/or restart) and who is notified when anomalies are detected.

CSP Implementation Tips: None