Assessment Objective
Determine if:
- SA-08[01] [Assignment: systems security engineering principles] are applied in the specification of the system and system components;
- SA-08[02] [Assignment: systems security engineering principles] are applied in the design of the system and system components;
- SA-08[03] [Assignment: systems security engineering principles] are applied in the development of the system and system components;
- SA-08[04] [Assignment: systems security engineering principles] are applied in the implementation of the system and system components;
- SA-08[05] [Assignment: systems security engineering principles] are applied in the modification of the system and system components;
- SA-08[06] [Assignment: privacy engineering principles] are applied in the specification of the system and system components;
- SA-08[07] [Assignment: privacy engineering principles] are applied in the design of the system and system components;
- SA-08[08] [Assignment: privacy engineering principles] are applied in the development of the system and system components;
- SA-08[09] [Assignment: privacy engineering principles] are applied in the implementation of the system and system components;
- SA-08[10] [Assignment: privacy engineering principles] are applied in the modification of the system and system components.
Assessment Methods
Examine
- System and services acquisition policy
- system and services acquisition procedures
- assessment and authorization procedures
- procedures addressing security and privacy engineering principles used in the specification, design, development, implementation, and modification of the system
- system design documentation
- security and privacy requirements and specifications for the system
- system security plan
- privacy plan
- privacy impact assessment
- privacy risk assessment documentation
- other relevant documents or records
Interview
- Organizational personnel with acquisition/contracting responsibilities
- organizational personnel with information security and privacy responsibilities
- organizational personnel with system specification, design, development, implementation, and modification responsibilities
- system developers
Test
- Organizational processes for applying security and privacy engineering principles in system specification, design, development, implementation, and modification
- mechanisms supporting the application of security and privacy engineering principles in system specification, design, development, implementation, and modification
Linkede sager
| Linktype | Sag |
|---|---|
| blocks | SA-08 [H] Security and Privacy Engineering Principles |