id: "SI-10(03)" title: "Predictable Behavior" family: "SI" family_name: "System and Information Integrity" sort_id: "si-10.03" priority: "P1" implementation_level: "system" parent: "SI-10" enhancement: True
Statement
Verify that the system behaves in a predictable and documented manner when invalid inputs are received.
Guidance
A common vulnerability in organizational systems is unpredictable behavior when invalid inputs are received. Verification of system predictability helps ensure that the system behaves as expected when invalid inputs are received. This occurs by specifying system responses that allow the system to transition to known states without adverse, unintended side effects. The invalid inputs are those related to the information inputs defined by the organization in the base control ( SI-10).
Assessment Objective: the system behaves in a predictable manner when invalid inputs are received;
Assessment Objective: the system behaves in a documented manner when invalid inputs are received.
System and information integrity policy
system and information integrity procedures
procedures addressing information input validation
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Organizational personnel responsible for information input validation
organizational personnel with information security responsibilities
system/network administrators
system developer
Automated mechanisms supporting and/or implementing predictable behavior when invalid inputs are received