PW.2 Review the Software Design to Verify Compliance with Security Requirements and Risk Information

Statement

Have 1) a qualified person (or people) who were not involved with the design and/or 2) automated processes instantiated in the toolchain review the software design to confirm and enforce that it meets all of the security requirements and satisfactorily addresses the identified risk information.

Example 1:

Review the software design to confirm that it addresses applicable security requirements.

Example 2:

Review the risk models created during software design to determine if they appear to adequately identify the risks.

Example 3:

Review the software design to confirm that it satisfactorily addresses the risks identified by the risk models.

Example 4:

Have the software’s designer correct failures to meet the requirements.

Example 5:

Change the design and/or the risk response strategy if the security requirements cannot be met.

Example 6:

Record the findings of design reviews to serve as artifacts (e.g., in the software specification, in the issue tracking system, in the threat model).