Assessment Objective
Determine if:
- SA-15(07)(a) the developer of the system, system component, or system service is required to perform automated vulnerability analysis [Assignment: frequency] using [Assignment: tools];
- SA-15(07)(b) the developer of the system, system component, or system service is required to determine the exploitation potential for discovered vulnerabilities [Assignment: frequency];
- SA-15(07)(c) the developer of the system, system component, or system service is required to determine potential risk mitigations [Assignment: frequency] for delivered vulnerabilities;
- SA-15(07)(d) the developer of the system, system component, or system service is required to deliver the outputs of the tools and results of the analysis [Assignment: frequency] to [Assignment: personnel or roles].
Assessment Methods
Examine
- System and services acquisition policy
- procedures addressing development process, standards, and tools
- solicitation documentation
- acquisition documentation
- service level agreements
- acquisition contracts for the system, system component, or system service
- vulnerability analysis tools and associated documentation
- risk assessment reports
- vulnerability analysis results
- vulnerability mitigation reports
- risk mitigation strategy documentation
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system and service acquisition responsibilities
- organizational personnel with information security responsibilities
- system developer
- organizational personnel performing automated vulnerability analysis on the system
Test
- Organizational processes for vulnerability analysis of systems, system components, or system services under development
- mechanisms supporting and/or implementing vulnerability analysis of systems, system components, or system services under development
Propojené úkoly
| Typ vazby | Úkol |
|---|---|
| blocks | SA-15(07) Automated Vulnerability Analysis |