Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

si-13

predictable failure prevention

assessment objective:

Determine if the organization:

si-13(a)

si-13(a)[1]

defines information system components for which mean time to failure (MTTF) should be determined;

si-13(a)[2]

determines MTTF for organization-defined information system components in specific environments of operation;

si-13(b)

si-13(b)[1]

defines MTTF substitution criteria to be used as a means to exchange active and standby components;

si-13(b)[2]

provides substitute information system components at organization-defined MTTF substitution criteria; and

si-13(b)[3]

provides a means to exchange active and standby components at organization-defined MTTF substitution criteria.

potential assessment methods and objects:

Examine: [select from: System and information integrity policy; procedures addressing predictable failure prevention; information system design documentation; information system configuration settings and associated documentation; list of MTTF substitution criteria; information system audit records; other relevant documents or records].

Interview: [select from: Organizational personnel with responsibility for MTTF determinations and activities; organizational personnel with information security responsibilities; system/network administrators; organizational personnel with contingency planning responsibilities].

Test: [select from: Organizational processes for managing MTTF].