SI-13 has two requirements. Determine the mean time to failure for the components you name in their specific environments, and provide substitute components and a way to swap active and standby ones under criteria you set.
800-53 binds federal systems and contractors. A small company can use it to explain high availability for its security tooling.
What it means in practice
NIST says MTTF is mainly a reliability matter, but here it is meant for components that provide security capabilities. Think firewalls, identity providers, log collectors and key management. Failure rates should reflect your installation and not an industry average. The handover to a standby must not weaken safety or security, and system state needs to survive the switch.
Enhancements add detail: SI-13(1) Transferring Component Responsibilities, SI-13(2) Time Limit on Process Execution Without Supervision, SI-13(3) Manual Transfer Between Components, SI-13(4) Standby Component Installation and Notification, and SI-13(5) Failover Capability.
Evidence to collect
- A list of security critical components with their expected life or failure data.
- Standby or redundancy design for each.
- A failover test record.
- Replacement criteria, for example age or error rate.
Common gaps
Single instance log collectors or identity providers. Failover that has never been tested. Standbys that run an older config.
How to implement it
Find the single points of failure among security tools, add a standby, and test the switch twice a year.
Quick check
Which components does SI-13 focus on?
Components that provide security capabilities, not every part of the system.
