+SA-08(31) Secure System Modification
|
SA-08(31) Secure System Modification
Control
Implement the security design principle of secure system modification in [Assignement: systems or system components].
Discussion
The principle of secure system modification states that system modification maintains system security with respect to the security requirements and risk tolerance of stakeholders. Upgrades or modifications to systems can transform secure systems into systems that are not secure. The procedures for system modification ensure that if the system is to maintain its trustworthiness, the same rigor that was applied to its initial development is applied to any system changes. Because modifications can affect the ability of the system to maintain its secure state, a careful security analysis of the modification is needed prior to its implementation and deployment. This principle parallels the principle of secure evolvability.
Assessment Objective
[Assignement: systems or system components] implement the security design principle of secure system modification.
Assessment Method
Examine
System and services acquisition policy
configuration management policy and procedures
procedures addressing the security design principle of secure system modification used in the specification, design, development, implementation, and modification of the system
system design documentation
system configuration settings and associated documentation
change control records
security and privacy requirements and specifications for the system
system security and privacy architecture
system security plan
other relevant documents or records
Interview
Organizational personnel with the responsibility for determining system security and privacy requirements
organizational personnel with system specification, design, development, implementation, and modification responsibilities
system developers
organizational personnel with information security responsibilities
1. Přehled
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|