Navigate

SC-24

SC-24: Fail In Known State

The information system fails to a [Assignment: organization-defined known-state] for [Assignment: organization-defined types of failures] preserving [Assignment: organization-defined system state information] in failure.

Supplemental

Failure in a known state addresses security concerns in accordance with the mission/business needs of organizations. Failure in a known secure state helps to prevent the loss of confidentiality, integrity, or availability of information in the event of failures of organizational information systems or system components. Failure in a known safe state helps to prevent systems from failing to a state that may cause injury to individuals or destruction to property. Preserving information system state information facilitates system restart and return to the operational mode of organizations with less disruption of mission/business processes.

CIA Levels
Confidentiality	high
Integrity	high
Availability	unknown

Overlays
Int-C

Related Controls

The controls below (if any) were marked by NIST as being related to SC-24.

Control	Description
CP-2	The organization: CP-2a.: Develops a contingency plan for the information system that: CP-2a.1.: Identifies essential missions and business functions and associated contingency requirements; CP-2a.2.: Provides recovery objectives, restoration priorities, and metrics; CP-2a.3.: Addresses contingency roles, responsibilities, assigned individuals with contact information; CP-2a.4.: Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure; CP-2a.5.: Addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented; and CP-2a.6.: Is reviewed and approved by [Assignment: organization-defined personnel or roles]; CP-2b.: Distributes copies of the contingency plan to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; CP-2c.: Coordinates contingency planning activities with incident handling activities; CP-2d.: Reviews the contingency plan for the information system [Assignment: organization-defined frequency]; CP-2e.: Updates the contingency plan to address changes to the organization, information system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing; CP-2f.: Communicates contingency plan changes to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; and CP-2g.: Protects the contingency plan from unauthorized disclosure and modification.
CP-10	The organization provides for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.
CP-12	The information system, when [Assignment: organization-defined conditions] are detected, enters a safe mode of operation with [Assignment: organization-defined restrictions of safe mode of operation].
SC-7	The information system: SC-7a.: Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; SC-7b.: Implements subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and SC-7c.: Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.
SC-22	The information systems that collectively provide name/address resolution service for an organization are fault-tolerant and implement internal/external role separation.

Enhancements

The controls below (if any) add on to the requirements of SC-24.

Control	Description
No controls

Related CCIs

The CCIs below are tied to SC-24.

CCI	Definition
CCI-001190	The information system fails to an organization-defined known-state for organization-defined types of failures.
CCI-001191	The organization defines the known states the information system should fail to in the event of an organization-defined system failure.
CCI-001192	The organization defines types of failures for which the information system should fail to an organization-defined known state.
CCI-001193	The organization defines system state information that should be preserved in the event of a system failure.
CCI-001665	The information system preserves organization-defined system state information in the event of a system failure.