id: "SI-02(07)" title: "Root Cause Analysis" family: "SI" family_name: "System and Information Integrity" sort_id: "si-02.07" priority: "P1" implementation_level: "system" parent: "SI-02" enhancement: True

Conduct root cause analysis to identify underlying causes of issues or failures.

Develop actions to address the root cause of the issue or failure.

Implement the actions and monitor the implementation for effectiveness.

Guidance

Root cause analysis includes a wide range of approaches, tools, and techniques to systematically identify the underlying cause of issues or failures to systems and systems components (hardware, software, and firmware). Organizations consider the severity of the incident to determine what root cause analysis method is used and how quickly implementation of the remediation actions. The root cause analysis includes a timeline, missed warning signs, key decisions, gaps, mitigations, and verification of effectiveness. The actions identified to address the source of the issue are implemented and integrated into applicable organizational policy, procedures, and control implementation.

Assessment Objective

Determine if:

Assessment Objective: Root cause analysis is conducted to identify underlying causes of issues or failures

Assessment Objective: Actions to address the root cause of the issue of failure are developed

Assessment Objective: The actions (defined in SI-02(07)b.) are implemented

Assessment Objective: The implementation of actions is monitored for effectiveness.

System and information integrity policy;

system and information integrity procedures;

procedures addressing flaw remediation;

procedures addressing root cause analysis/process improvement;

system design documentation;

system configuration settings and associated documentation;

system audit records;

system security and privacy plan;

other relevant documents or records

System/network administrators;

organizational personnel with information security and privacy responsibilities;

organizational personnel responsible for installing, configuring, and/or maintaining the system;

organizational personnel responsible for flaw remediation;

organizational personnel with configuration management responsibilities

Organizational processes for identifying, reporting, and correcting system flaws;

organizational process for installing software and firmware updates;

mechanisms supporting and/or implementing the reporting and correcting of system flaws;

mechanisms supporting and/or implementing testing software and firmware updates