Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- TDA-03_A01 cybersecurity / data privacy systems engineering methods are defined.
Assessment rigor: 1
Origin: 53A_R5_SA-04(03)_ODP[01] 53A_R5_SA-04(03)_ODP[02] 53A_R5_SA-04(03)_ODP[03] 53A_R5_SA-04(03)_ODP[04] - TDA-03_A02 software development methods are defined.
Assessment rigor: 1
Origin: 53A_R5_SA-04(03)_ODP[05] 53A_R5_SA-04(03)_ODP[06] - TDA-03_A03 testing, evaluation, assessment, verification and validation methods are defined.
Assessment rigor: 1
Origin: 53A_R5_SA-04(03)_ODP[07] - TDA-03_A04 quality control processes are defined.
Assessment rigor: 1
Origin: 53A_R5_SA-04(03)_ODP[08] - TDA-03_A05 the developer of the system, system component or system service is required to demonstrate the use of a system development life cycle process that includes organization-defined system security engineering methods.
Assessment rigor: 1
Origin: 53A_R5_SA-04(03)(a) 53A_R5_SA-04(03)(b) 53A_R5_SA-04(03)(c) - TDA-03_A06 systems security engineering principles to be applied to the development or modification of the system and system components are defined.
Assessment rigor: 2
Origin: 171A_R3_A.03.16.01.ODP[01] - TDA-03_A07 <A.03.16.01.ODP[01]: systems security engineering principles> are applied to the development or modification of the system and system components.
Defined parameters: Guidance: At a minimum, documentation that provides user and administrator guidance for the implementation and operation of controls. The level of detail required in such documentation should be based on the degree to which organizations depend on the capabilities, functions, or mechanisms to meet risk response expectations. Requirements can include mandated configuration settings that specify allowed functions, ports, protocols, and services. Acceptance criteria for systems, system components, and system services are defined in the same manner as the criteria for any organizational acquisition or procurement.
Assessment rigor: NIST 800-171
Origin: 171A_R3_A.03.16.01
Свързани задачи
| Тип връзка | Задача |
|---|---|
| blocks | Development Methods, Techniques & Processes |
- Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.
DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.