SI-6 Security and Privacy Function Verification
Control
Verify the correct operation of [Assignment: organization-defined security and privacy functions];
Perform the verification of the functions specified in SI-6a [Assignment: Selection (one-or-more): [si-06_odp.04] | upon command by user with appropriate privilege | [si-06_odp.05] ];
Alert [Assignment: personnel or roles] to failed security and privacy verification tests; and
[Assignment: Selection (one-or-more): shut the system down | restart the system | [si-06_odp.08] ] when anomalies are discovered.
Discussion
Transitional states for systems include system startup, restart, shutdown, and abort. System notifications include hardware indicator lights, electronic alerts to system administrators, and messages to local computer consoles. In contrast to security function verification, privacy function verification ensures that privacy functions operate as expected and are approved by the senior agency official for privacy or that privacy attributes are applied or used as expected.
Control enhancements (3)
Related controls
Need SI-6 implemented and evidenced?
We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.
Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.