SI-10(1)

Requirement
1. Provide a manual override capability for input validation of the following information inputs: [Assignment: organization-defined inputs defined in the base control (SI-10)];
2. Restrict the use of the manual override capability to only [Assignment: organization-defined authorized individuals]; and
3. Audit the use of the manual override capability.

Discussion

In certain situations, such as during events that are defined in contingency plans, a manual override capability for input validation may be needed. Manual overrides are used only in limited circumstances and with the inputs defined by the organization.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; access control policy and procedures; separation of duties policy and procedures; procedures addressing information input validation; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel responsible for information input validation; organizational personnel with information security responsibilities; system/network administrators; system developer].

Test

[SELECT FROM: Organizational processes for the use of a manual override capability; mechanisms supporting and/or implementing a manual override capability for input validation; mechanisms supporting and/or implementing auditing of the use of a manual override capability].

ID	Assessment Objectives
SI-10(01)(a)	a manual override capability for the validation of <SI-10_ODP information inputs> is provided;
SI-10(01)(b)	the use of the manual override capability is restricted to only <SI-10(01)_ODP authorized individuals>;
SI-10(01)(c)	the use of the manual override capability is audited.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!