NIST 800-53 r5 · Controls catalogue · Family SI
SI-17Fail-safe Procedures
Implement the indicated fail-safe procedures when the indicated failures occur: {{ insert: param, si-17_prm_1 }}.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 1 mapping(s) from 1 framework(s): ASVS 5.0 1 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (8)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-404 | Improper Resource Shutdown or Release | 807 | Procedures can mandate orderly shutdown or release of resources when failures occur, preventing improper resource handling after a fault. |
CWE-755 | Improper Handling of Exceptional Conditions | 677 | Mandates defined procedures that ensure exceptional conditions are handled in a controlled, secure manner instead of being ignored or mishandled. |
CWE-209 | Generation of Error Message Containing Sensitive Information | 666 | Fail-safe procedures can be defined to suppress or sanitize error output, reducing generation of messages that contain sensitive information. |
CWE-459 | Incomplete Cleanup | 225 | Fail-safe procedures can explicitly require cleanup of temporary state, resources, or privileges on failure to avoid leaving the system in an inconsistent state. |
CWE-248 | Uncaught Exception | 219 | Requires pre-defined safe responses for uncaught exceptions so they do not result in undefined or insecure program termination. |
CWE-703 | Improper Check or Handling of Exceptional Conditions | 150 | Requires explicit, safe handling actions for specified exceptional conditions rather than allowing unchecked propagation or default unsafe behavior. |
CWE-636 | Not Failing Securely ('Failing Open') | 35 | Directly implements fail-safe (fail-closed/secure) behavior on indicated failures, preventing the system from defaulting to an insecure open state. |
CWE-390 | Detection of Error Condition Without Action | 18 | Ensures that detected error conditions trigger the specified safe procedures instead of being observed without corrective action. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2026-31389 | 5.5 | 7.8 | 0.0012 | partial |
CVE-2026-26741 | 5.5 | 8.1 | 0.0026 | good |
CVE-2022-36127 | 5.5 | 7.5 | 0.0159 | good |
CVE-2024-6119 | 8.0 | 7.5 | 0.6659 | partial |
CVE-2026-27586 | 7.0 | 9.1 | 0.0027 | good |
CVE-2026-39393 | 5.5 | 8.1 | 0.0042 | good |