NIST 800-53 REV 5 • SYSTEM AND INFORMATION INTEGRITY
SI-10(3) — Predictable Behavior
Verify that the system behaves in a predictable and documented manner when invalid inputs are received.
CMMC Practice Mapping
No direct CMMC mapping
NIST 800-171 Mapping
No direct NIST 800-171 mapping
Related Controls
No related controls listed
Supplemental Guidance
A common vulnerability in organizational systems is unpredictable behavior when invalid inputs are received. Verification of system predictability helps ensure that the system behaves as expected when invalid inputs are received. This occurs by specifying system responses that allow the system to transition to known states without adverse, unintended side effects. The invalid inputs are those related to the information inputs defined by the organization in the base control ( [SI-10](#si-10)).
Practitioner Notes
Your system should behave predictably when it receives invalid input — always producing the same response to the same invalid input, not crashing or behaving erratically.
Example 1: Test your applications with fuzzing tools (like OWASP ZAP's fuzzer) that send random and malformed input. The application should consistently return appropriate error messages without crashing, hanging, or exposing stack traces.
Example 2: Implement consistent error handling in your code that catches all exceptions from input processing and returns a standardized error response. Never let unhandled exceptions reach the user — they should see a generic error page, not a debug dump.