CCI-001319

The organization takes information system components out of service by transferring component responsibilities to a substitute component no later than an organization-defined fraction or percentage of mean time to failure (MTTF).

Implementation Guidance

The organization being inspected/assessed documents and implements a process to take the information system components out of service by transferring component responsibilities to a substitute component no later than a fraction or percentage of mean time to failure defined in SI-13 (1), CCI 1320. The organization must maintain a log of component substitution.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process as well as the log of component substitution to ensure the organization being inspected/assessed takes the information system components out of service by transferring component responsibilities to a substitute component no later than a fraction or percentage of mean time to failure defined in SI-13 (1), CCI 1320.

Compelling Evidence

1.) Signed and dated System security plan with reference to section that defines process to take the information system components out of service by transferring component responsibilities to a substitute component no later than a fraction or percentage of mean time to failure defined in SI-13 (1), CCI 1320. 2.) Log of component substitution.

The controls below (if any) were marked by NIST as being related to CCI-001319.