NOD-006 — Isolate a Node

Go to Node Requirements

The DIDO-TE SHALL isolate a Node when a condition specified by the applicable Test Definition requires isolation.

• [DTE5] DIDO-TE Requirements Register, source requirement identifier and obligation to be assigned
• [DTE6] Structured Information Processing Reference Architecture (SIP-RA)
• [DTE7] Federated Data Interpretation Systems Reference Architecture (FDIS-RA)

Node isolation prevents an identified Node from exchanging data, control, services, or resources through interactions prohibited by the applicable Test Definition.

The Test Definition identifies the conditions that require isolation, the required isolation scope, the interactions permitted during isolation, the responsible authority, and the conditions required for release. The applicable Test Procedure identifies the actions used to isolate and release the Node.

Conditions requiring isolation include an invalid lifecycle state, unsuccessful validation, loss of readiness, unauthorized interaction, unexpected behavior, compromised security, incorrect Node Configuration, invalid Node Binding, resource misuse, or an unresolved Test Execution Exception.

Isolation restricts or terminates selected Node Bindings, interfaces, services, processes, data flows, control paths, credentials, or access to Test Resources. The isolation scope protects affected Test Executions without unnecessarily affecting unrelated Nodes, Test Resources, or Test Environments.

Isolation differs from stopping a Node. A stopped Node occupies a defined non-operating state. An isolated Node remains available for authorized observation, diagnosis, evidence collection, remediation, recovery, or controlled stopping while prohibited interactions remain restricted.

Controlled isolation preserves the Node state and information required to determine the cause, scope, and effect of the triggering condition. It also prevents the condition from affecting other Nodes, Test Resources, Test Results, or Test Environments.

• DIDO-TE
• Node
• Node Definition
• Node Implementation
• Node Configuration
• Node Binding
• Dependency
• Test Definition
• Test Procedure
• Test Environment
• Test Execution
• Test Execution Exception
• Test Resource
• Test Result
• Authorizing Authority
• Evidence
• Traceability

Verification confirms that:

1. The applicable Test Definition identifies each condition that requires Node isolation.
2. Each identified condition specifies the required isolation scope, permitted interactions, responsible authority, and release conditions.
3. The applicable Test Procedure identifies the actions required to isolate and release the Node.
4. The DIDO-TE detects when a Node satisfies an identified condition requiring isolation.
5. The DIDO-TE uniquely identifies the Node subject to isolation.
6. The DIDO-TE identifies the affected Test Environment and Test Executions.
7. The DIDO-TE identifies the lifecycle and execution states of the Node before isolation.
8. The DIDO-TE verifies the identity of the target Node before applying isolation controls.
9. The DIDO-TE determines which Node Bindings, interfaces, services, processes, data flows, control paths, credentials, Dependencies, and Test Resources require restriction.
10. The DIDO-TE applies the isolation actions specified by the applicable Test Procedure.
11. The DIDO-TE prevents the isolated Node from initiating or receiving prohibited interactions.
12. The DIDO-TE preserves interactions authorized for observation, diagnosis, evidence collection, remediation, recovery, or controlled stopping.
13. The DIDO-TE prevents isolation controls from unnecessarily affecting unrelated Nodes, Test Resources, Test Environments, or Test Executions.
14. The DIDO-TE verifies the completion and effectiveness of each material isolation action.
15. The DIDO-TE detects an incomplete, unsuccessful, interrupted, bypassed, incorrectly scoped, or unauthorized isolation action.
16. The DIDO-TE detects a prohibited interaction attempted by or directed to the isolated Node.
17. The DIDO-TE identifies interactions that occurred between detection of the isolation condition and effective isolation.
18. The DIDO-TE determines the effect of isolation on affected Test Inputs, observations, outputs, Test Resources, Test Executions, and Test Results.
19. The DIDO-TE preserves the Node state, configuration, logs, observations, and other information required for diagnosis and Evidence.
20. The DIDO-TE assigns a distinguishable isolation status to the Node.
21. The DIDO-TE prevents an isolated Node from resuming prohibited interactions before satisfaction of the applicable release conditions.
22. The DIDO-TE verifies the Node Configuration, Node Bindings, lifecycle state, validation status, and readiness status before releasing the Node.
23. The DIDO-TE obtains approval from the applicable Authorizing Authority when the Test Definition or Test Procedure requires approval before release.
24. An unsuccessful isolation leaves the Node in a known state or identifies the actual resulting state and required corrective or escalation action.
25. The DIDO-TE records the Node identity, triggering condition, responsible authority, Test Procedure, source state, isolation scope, restrictions, actions, timing, resulting state, findings, exceptions, affected Test Executions, and release status.
26. The DIDO-TE maintains Traceability among the triggering condition, Node Definition, Node Implementation, Node Configuration, Node Bindings, Test Definition, Test Procedure, isolation actions, Test Environment, affected Test Executions, Test Results, release decision, and resulting Evidence.
27. A missing, delayed, incomplete, ineffective, bypassed, incorrectly scoped, unauthorized, prematurely released, or untraceable Node isolation constitutes nonconformance with this requirement.

The following pages reference this requirement:

Assign the applicable delivery phase.

Assign the implementation status.

The proposed derived requirement requires review and acceptance.

Assign the source requirement identifier and obligation from the DIDO-TE Requirements Register.

Use the following DokuWiki section-transclusion syntax to reference this requirement’s Statement section:

{{section>dido:03-dido-te:99-annexes:annex-c-requirements:03-node-requirements:nod-006-isolate-a-node#Statement&noheader&nofooter&noeditbtn}}