Assessment Objective
Determine if:
- SA-11(03)(a)
- SA-11(03)(a)[01] an independent agent is required to satisfy [Assignment: independence criteria] to verify the correct implementation of the developer security assessment plan and the evidence produced during testing and evaluation;
- SA-11(03)(a)[02] an independent agent is required to satisfy [Assignment: independence criteria] to verify the correct implementation of the developer privacy assessment plan and the evidence produced during testing and evaluation;
- SA-11(03)(b) the independent agent is provided with sufficient information to complete the verification process or granted the authority to obtain such information.
Assessment Methods
Examine
- System and services acquisition policy
- system and services acquisition procedures
- procedures addressing system developer security testing
- solicitation documentation
- acquisition documentation
- service level agreements
- acquisition contracts for the system, system component, or system service
- independent verification and validation reports
- security and privacy assessment plans
- results of security and privacy assessments for the system, system component, or system service
- system security plan
- privacy plan
- privacy program plan
- other relevant documents or records
Interview
- Organizational personnel with system and service acquisition responsibilities
- organizational personnel with information security and privacy responsibilities
- organizational personnel with developer security testing responsibilities
- system developers
- independent verification agent
Test
- Organizational processes for monitoring developer security testing and evaluation
- mechanisms supporting and/or implementing the monitoring of developer security testing and evaluation
Linkede sager
| Linktype | Sag |
|---|---|
| blocks | SA-11(03) Independent Verification of Assessment Plans and Evidence |