BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

SC-07(18) Fail Secure

NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
unchanged SC High baseline part of SC-7

Title

Fail Secure

Control

Prevent systems from entering unsecure states in the event of an operational failure of a boundary protection device.

Discussion

Fail secure is a condition achieved by employing mechanisms to ensure that in the event of operational failures of boundary protection devices at managed interfaces, systems do not enter into unsecure states where intended security properties no longer hold. Managed interfaces include routers, firewalls, and application gateways that reside on protected subnetworks (commonly referred to as demilitarized zones). Failures of boundary protection devices cannot lead to or cause information external to the devices to enter the devices nor can failures permit unauthorized information releases.

Related controls

cp-12, cp-2, sc-24

Assessment objective

SC-07(18) systems are prevented from entering unsecure states in the event of an operational failure of a boundary protection device.

STIG rules that implement this control 0

No followed STIG rule cites a CCI indexed to this control (CCI list 2026-07-14).