Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

si-11

error handling

assessment objective:

Determine if:

si-11(a)

the information system generates error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries;

si-11(b)

si-11(b)[1]

the organization defines personnel or roles to whom error messages are to be revealed; and

si-11(b)[2]

the information system reveals error messages only to organization-defined personnel or roles.

potential assessment methods and objects:

Examine: [select from: System and information integrity policy; procedures addressing information system error handling; information system design documentation; information system configuration settings and associated documentation; documentation providing structure/content of error messages; information system audit records; other relevant documents or records].

Interview: [select from: Organizational personnel with responsibility for information input validation; organizational personnel with information security responsibilities; system/network administrators; system developer].

Test: [select from: Organizational processes for error handling; automated mechanisms supporting and/or implementing error handling; automated mechanisms supporting and/or implementing management of error messages].