NIST 800-53 r5 · Controls catalogue · Family SI
SI-13Predictable Failure Prevention
Determine mean time to failure (MTTF) for the following system components in specific environments of operation: {{ insert: param, si-13_odp.01 }} ; and Provide substitute system components and a means to exchange active and standby components in accordance with the following criteria: {{ insert: param, si-13_odp.02 }}.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 1 mapping(s) from 1 framework(s): CSF 2.0 1 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (6)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-400 | Uncontrolled Resource Consumption | 3,572 | MTTF monitoring plus ready substitutes directly mitigate sustained resource exhaustion by allowing component swap before or at failure. |
CWE-770 | Allocation of Resources Without Limits or Throttling | 2,210 | Pre-planned substitution limits the window an attacker can exploit unbounded allocation to cause predictable component failure. |
CWE-754 | Improper Check for Unusual or Exceptional Conditions | 730 | MTTF determination forces explicit checks for conditions that precede predictable component failure. |
CWE-755 | Improper Handling of Exceptional Conditions | 677 | Prepared component exchange provides a defined recovery path, making improper handling of failures less exploitable. |
CWE-703 | Improper Check or Handling of Exceptional Conditions | 150 | Requires systematic prediction and handling of failure conditions, reducing the impact of unhandled exceptional states. |
CWE-636 | Not Failing Securely ('Failing Open') | 35 | Standby components and explicit exchange criteria enforce a controlled, secure failover instead of failing open. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2026-34063 | 5.5 | 7.5 | 0.0035 | good |
CVE-2026-20049 | 5.5 | 7.7 | 0.0029 | good |