SI-10(3)—Information Input Validation | Predictable Behavior
IL5
IL6
>Control Description
Verify that the system behaves in a predictable and documented manner when invalid inputs are received.
>DoD Impact Level Requirements
No specific parameter values or requirements for this impact level.
>Discussion
A common vulnerability in organizational systems is unpredictable behavior when invalid inputs are received. Verification of system predictability helps ensure that the system behaves as expected when invalid inputs are received. This occurs by specifying system responses that allow the system to transition to known states without adverse, unintended side effects.
The invalid inputs are those related to the information inputs defined by the organization in the base control (SI-10).
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What policies and procedures govern predictable behavior?
- •Who is responsible for monitoring system and information integrity?
- •How frequently are integrity monitoring processes reviewed and updated?
- •What is your process for identifying, reporting, and remediating flaws and vulnerabilities?
Technical Implementation:
- •What technical controls detect and respond to predictable behavior issues?
- •How are integrity violations identified and reported?
- •What automated tools support system and information integrity monitoring?
- •What tools are used to identify software flaws and vulnerabilities?
Evidence & Documentation:
- •Can you provide recent integrity monitoring reports or alerts?
- •What logs demonstrate that SI-10(3) is actively implemented?
- •Where is evidence of integrity monitoring maintained and for how long?
- •Can you provide recent vulnerability reports and POA&M items?
Ask AI
Configure your API key to use AI features.