SI-10(3)

Requirement

Verify that the system behaves in a predictable and documented manner when invalid inputs are received.

Discussion

A common vulnerability in organizational systems is unpredictable behavior when invalid inputs are received. Verification of system predictability helps ensure that the system behaves as expected when invalid inputs are received. This occurs by specifying system responses that allow the system to transition to known states without adverse, unintended side effects. The invalid inputs are those related to the information inputs defined by the organization in the base control (SI-10).

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing information input validation; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel responsible for information input validation; organizational personnel with information security responsibilities; system/network administrators; system developer].

Test

[SELECT FROM: Automated mechanisms supporting and/or implementing predictable behavior when invalid inputs are received].

ID	Assessment Objectives
SI-10(03)[01]	the system behaves in a predictable manner when invalid inputs are received;
SI-10(03)[02]	the system behaves in a documented manner when invalid inputs are received.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!