SI-17 asks you to implement fail-safe procedures when specified failures occur. The organization picks the failure conditions and the procedures. NIST 800-53 binds US federal systems and, through contract, some others. For everyone else it is a reference you can borrow when a customer or auditor asks how your systems behave when something breaks.
What it means in practice
NIST's guidance names loss of communications among critical components, or between components and operational facilities, as a failure condition. A fail-safe procedure alerts operators and gives specific instructions for what happens next. The guidance lists the possible next steps: do nothing, reestablish settings, shut down processes, restart the system, or contact designated people.
The point is that the response is decided before the failure, not improvised during it. "Do nothing" is a legitimate answer if you wrote it down on purpose.
Evidence to collect
- A list of the failure conditions you chose, such as loss of connection to an identity provider, a policy service, or a message queue.
- For each one, the documented response and who is alerted.
- Runbooks or configuration showing the behavior, for example a service that denies requests when its authorization backend is unreachable.
- A test record or game day report showing the failure was simulated and the response matched the document.
Common gaps
- Defaults nobody chose. A gate that fails open because the timeout handler was never written is a fail-safe decision made by accident.
- Alerts that go to a channel nobody watches.
- Procedures that exist but were never exercised.
How to implement it
Start with the systems whose failure would hurt security: authentication, authorization, logging, and deployment gates. For each, write one line: failure, behavior (open or closed), alert target, next step. Then test one a quarter by cutting the dependency in a staging environment.
Quick check
Is failing open ever acceptable under SI-17?
Yes, if it is a documented, risk-accepted decision for that failure condition. The control wants a defined procedure, not a particular direction.
