SI-6 asks you to verify the correct operation of defined security and privacy functions, perform that verification at defined times, alert defined personnel to failed tests, and take defined actions when anomalies appear. NIST 800-53 binds US federal systems and, by contract, some others. For other teams it is a good prompt to test your controls instead of assuming them.
What it means in practice
The guidance lists transitional states such as startup, restart, shutdown and abort as times verification may be needed. Notifications can be as simple as hardware indicator lights, alerts to administrators or messages on a console. It also separates privacy function verification: privacy functions must operate as expected, and privacy attributes must be applied or used as expected.
In a modern stack this looks like a check that the logging agent is running after a deploy, that encryption settings are still on, or that a consent flag is honored by a service.
The enhancements cover notification of failed security tests (SI-6.1), automation support for distributed testing (SI-6.2) and reporting verification results (SI-6.3).
Evidence to collect
- The list of security and privacy functions you verify and the trigger for each.
- Test definitions, scripts or monitors.
- Alert routing to the people who respond.
- Records of failed checks and what was done.
- Periodic reports of verification results.
Common gaps
- Controls assumed to work because they were configured once.
- Tests that run but alert nobody.
- Nothing verified after restarts or deployments.
- Privacy functions left out entirely.
How to implement it
Pick your ten most important controls. For each, write a check that proves the control is on right now, run it after startup and on a schedule, and send failures to a monitored channel. Keep a monthly summary.
Quick check
Does SI-6 cover privacy as well as security?
Yes. The control names both security and privacy functions.
