+SR-09(01) Multiple Stages of System Development Life Cycle
|
SR-09(01) Multiple Stages of System Development Life Cycle
Control
Employ anti-tamper technologies, tools, and techniques throughout the system development life cycle.
Discussion
The system development life cycle includes research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal. Organizations use a combination of hardware and software techniques for tamper resistance and detection. Organizations use obfuscation and self-checking to make reverse engineering and modifications more difficult, time-consuming, and expensive for adversaries. The customization of systems and system components can make substitutions easier to detect and therefore limit damage.
Assessment Objective
anti-tamper technologies, tools, and techniques are employed throughout the system development life cycle.
Assessment Method
Examine
Supply chain risk management policy and procedures
supply chain risk management plan
system and services acquisition policy
procedures addressing tamper resistance and detection
tamper protection program documentation
tamper protection tools and techniques documentation
tamper resistance and detection tools (technologies) and techniques documentation
system development life cycle documentation
procedures addressing supply chain protection
system development life cycle procedures
acquisition documentation
service level agreements
acquisition contracts for the system, system component, or system service
inter-organizational agreements and procedures
system security plan
other relevant documents or records
Interview
Organizational personnel with system and services acquisition responsibilities
organizational personnel with information security responsibilities
organizational personnel with supply chain risk management responsibilities
organizational personnel with SDLC responsibilities
1. Přehled
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|