Assessment Objective
Determine if:
- SA-04(05)(a) the developer of the system, system component, or system service is required to deliver the system, component, or service with [Assignment: security configurations] implemented;
- SA-04(05)(b) the configurations are used as the default for any subsequent system, component, or service reinstallation or upgrade.
Assessment Methods
Examine
- System and services acquisition policy
- procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process
- solicitation documents
- acquisition documentation
- acquisition contracts for the system, system component, or system service
- security configurations to be implemented by the developer of the system, system component, or system service
- service level agreements
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with acquisition/contracting responsibilities
- organizational personnel with the responsibility to determine system security requirements
- system developers or service provider
- organizational personnel with information security responsibilities
Test
- Mechanisms used to verify that the configuration of the system, component, or service is delivered as specified
Свързани задачи
| Тип връзка | Задача |
|---|---|
| blocks | SA-04(05) [H] System, Component, and Service Configurations |