Assessment Objective
Determine if:
- SA-04(02) the developer of the system, system component, or system service is required to provide design and implementation information for the controls that includes using [Selection (one or more): security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; [Assignment: design and implementation information] ] at [Assignment: level of detail].
Assessment Methods
Examine
- System and services acquisition policy
- system and services acquisition procedures
- procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process
- solicitation documents
- acquisition documentation
- acquisition contracts for the system, system components, or system services
- design and implementation information for controls employed in the system, system component, or system service
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with acquisition/contracting responsibilities
- organizational personnel with the responsibility to determine system security requirements
- system developers or service provider
- organizational personnel with information security responsibilities
Test
- Organizational processes for determining the level of detail for system design and controls
- organizational processes for developing acquisition contracts
- mechanisms supporting and/or implementing the development of system design details
Linkede sager
| Linktype | Sag |
|---|---|
| blocks | SA-04(02) Design and Implementation Information for Controls |