+SA-10(01) Software and Firmware Integrity Verification
|
SA-10(01) Software and Firmware Integrity Verification
Control
Require the developer of the system, system component, or system service to enable integrity verification of software and firmware components.
Discussion
Software and firmware integrity verification allows organizations to detect unauthorized changes to software and firmware components using developer-provided tools, techniques, and mechanisms. The integrity checking mechanisms can also address counterfeiting of software and firmware components. Organizations verify the integrity of software and firmware components, for example, through secure one-way hashes provided by developers. Delivered software and firmware components also include any updates to such components.
Assessment Objective
the developer of the system, system component, or system service is required to enable integrity verification of software and firmware components.
Assessment Method
Examine
System and services acquisition policy
procedures addressing system developer configuration management
solicitation documentation
acquisition documentation
service level agreements
acquisition contracts for the system, system component, or system service
system developer configuration management plan
software and firmware integrity verification records
system change authorization records
change control records
configuration management records
system security plan
supply chain risk management plan
other relevant documents or records
Interview
Organizational personnel with system and service acquisition responsibilities
organizational personnel with information security responsibilities
organizational personnel with configuration management responsibilities
system developers
organizational personnel with supply chain risk management responsibilities
1. Přehled
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|