+SA-10(02) Alternative Configuration Management Processes
|
SA-10(02) Alternative Configuration Management Processes
Control
Provide an alternate configuration management process using organizational personnel in the absence of a dedicated developer configuration management team.
Discussion
Alternate configuration management processes may be required when organizations use commercial off-the-shelf information technology products. Alternate configuration management processes include organizational personnel who review and approve proposed changes to systems, system components, and system services and conduct security and privacy impact analyses prior to the implementation of changes to systems, components, or services.
Assessment Objective
an alternate configuration management process has been provided using organizational personnel in the absence of a dedicated developer configuration management team.
Assessment Method
Examine
System and services acquisition policy
system and services acquisition procedures
configuration management policy
configuration management plan
solicitation documentation
acquisition documentation
service level agreements
acquisition contracts for the system, system component, or system service
system developer configuration management plan
security impact analyses
privacy impact analyses
privacy impact assessment
privacy risk assessment documentation
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with acquisition responsibilities
organizational personnel with information security and privacy responsibilities
organizational personnel with configuration management responsibilities
system developers
1. Přehled
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|