Navigate

SI-11

SI-11: Error Handling

The information system:

SI-11a.: Generates error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries; and

SI-11b.: Reveals error messages only to [Assignment: organization-defined personnel or roles].

Supplemental

Organizations carefully consider the structure/content of error messages. The extent to which information systems are able to identify and handle error conditions is guided by organizational policy and operational requirements. Information that could be exploited by adversaries includes, for example, erroneous logon attempts with passwords entered by mistake as the username, mission/business information that can be derived from (if not stated explicitly by) information recorded, and personal information such as account numbers, social security numbers, and credit card numbers. In addition, error messages may provide a covert channel for transmitting information.

CIA Levels
Confidentiality	unknown
Integrity	low
Availability	unknown

Overlays
Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

Related Controls

The controls below (if any) were marked by NIST as being related to SI-11.

Control	Description
AU-2	The organization: AU-2a.: Determines that the information system is capable of auditing the following events: [Assignment: organization-defined auditable events]; AU-2b.: Coordinates the security audit function with other organizational entities requiring audit-related information to enhance mutual support and to help guide the selection of auditable events; AU-2c.: Provides a rationale for why the auditable events are deemed to be adequate to support after-the-fact investigations of security incidents; and AU-2d.: Determines that the following events are to be audited within the information system: [Assignment: organization-defined audited events (the subset of the auditable events defined in AU-2 a.) along with the frequency of (or situation requiring) auditing for each identified event].
AU-3	The information system generates audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.
SC-31	The organization: SC-31a.: Performs a covert channel analysis to identify those aspects of communications within the information system that are potential avenues for covert [Selection (one or more): storage; timing] channels; and SC-31b.: Estimates the maximum bandwidth of those channels.

Enhancements

The controls below (if any) add on to the requirements of SI-11.

Control	Description
No controls

Related CCIs

The CCIs below are tied to SI-11.

CCI	Definition
CCI-001312	The information system generates error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.
CCI-001314	The information system reveals error messages only to organization-defined personnel or roles.
CCI-002759	The organization defines the personnel or roles to whom error messages are to be revealed.