SI-10(3): Predictable Behavior

Control Family:

System and Information Integrity

Parent Control:

SI-10: Information Input Validation

CSF v1.1 References:

PR.DS-6

Threats Addressed:

Tampering
Information Disclosure
Denial of Service
Elevation of Privilege

Baselines:

(Not part of any baseline)

Previous Version:

NIST Special Publication 800-53 Revision 4:
SI-10(3): Predictable Behavior

Control Statement

Verify that the system behaves in a predictable and documented manner when invalid inputs are received.

Supplemental Guidance

A common vulnerability in organizational systems is unpredictable behavior when invalid inputs are received. Verification of system predictability helps ensure that the system behaves as expected when invalid inputs are received. This occurs by specifying system responses that allow the system to transition to known states without adverse, unintended side effects. The invalid inputs are those related to the information inputs defined by the organization in the base control (SI-10).