SI-6 Security and Privacy Function Verification. Verify the correct operation of [organization-defined]; Perform the verification of the functions specified in SI-6a [organization-defined]; Alert [organization-defined] to failed security and privacy verification tests; and [organization-defined] when anomalies
Security and Privacy Function Verification. Verify the correct operation of [organization-defined]; Perform the verification of the functions specified in SI-6a [organization-defined]; Alert [organization-defined] to fai.
5
artefacts
1
held by a system
2
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Alerting configuration and records showing the defined personnel were alerted on a failed verification · SIEM / log platform
periodic reviewEvidence produced at each review
- The defined verification frequency or trigger, such as at startup, on command or periodically · Document repository
- The defined action taken when verification fails, such as shutdown, restart or notification, with evidence it executed · Document repository
governing documentDocuments that govern the control
- The defined security and privacy functions subject to verification · Policy repository / GRC workspace
- Verification results for the period, including passes and failures · Document repository
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your SIEM / log platform on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Verification covers whether a service is running rather than whether the security function operates correctly
- Failures logged with no alert, so a silently broken control persists
- The defined failure action never exercised, so its effect on availability is unknown and it is disabled in practice
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSI-5 Security alerts, advisories, and directives · SI-7 Software, firmware, and information integrity