SI-17 Fail-safe Procedures. Implement the indicated fail-safe procedures when the indicated failures occur: [organization-defined]
Fail-safe Procedures. Implement the indicated fail-safe procedures when the indicated failures occur: [organization-defined].
5
artefacts
0
held by a system
1
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence the fail-safe state does not itself create exposure, such as an open bypass · Document repository
governing documentDocuments that govern the control
- The defined failure conditions and the fail-safe procedure implemented for each · Policy repository / GRC workspace
- Design and configuration evidence implementing each fail-safe procedure · Policy repository / GRC workspace
- Test records demonstrating the procedure executes on the defined failure · Policy repository / GRC workspace
- Operator instructions for recovery from the fail-safe state · Document repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Fail-safe procedures documented for hardware failures while security mechanism failures fail open
- Procedures never triggered in test, so their real behaviour is unverified
- Recovery from fail-safe undefined, so operators improvise under pressure and leave the state inconsistent
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSI-16 Memory protection · SI-18 Personally Identifiable Information Quality Operations. Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle [organization-defined] ; and Correct or delete inaccurate or outdated personally identifiable information