+SA-15 Development Process, Standards, and Tools
---+SA-15(01) Quality Metrics
---+SA-15(02) Security and Privacy Tracking Tools
---+SA-15(03) Criticality Analysis
---+SA-15(05) Attack Surface Reduction
---+SA-15(06) Continuous Improvement
---+SA-15(07) Automated Vulnerability Analysis
---+SA-15(08) Reuse of Threat and Vulnerability Information
---+SA-15(10) Incident Response Plan
---+SA-15(11) Archive System or Component
---+SA-15(12) Minimize Personally Identifiable Information
---+SA-15(13) Logging Syntax

SA-15 Development Process, Standards, and Tools

Control

  1. Require the developer of the system, system component, or system service to follow a documented development process that:
    1. Explicitly addresses security and privacy requirements;
    2. Identifies the standards and tools used in the development process;
    3. Documents the specific tool options and tool configurations used in the development process; and
    4. Documents, manages, and ensures the integrity of changes to the process and/or tools used in development; and
  2. Review the development process, standards, tools, tool options, and tool configurations [Assignement: frequency] to determine if the process, standards, tools, tool options and tool configurations selected and employed can satisfy the following security and privacy requirements: [Assignement: organization-defined security and privacy requirements].

Discussion

Development tools include programming languages and computer-aided design systems. Reviews of development processes include the use of maturity models to determine the potential effectiveness of such processes. Maintaining the integrity of changes to tools and processes facilitates effective supply chain risk assessment and mitigation. Such integrity requires configuration control throughout the system development life cycle to track authorized changes and prevent unauthorized changes.

Assessment Objective

      1. the developer of the system, system component, or system service is required to follow a documented development process that explicitly addresses security requirements;
      2. the developer of the system, system component, or system service is required to follow a documented development process that explicitly addresses privacy requirements;
      1. the developer of the system, system component, or system service is required to follow a documented development process that identifies the standards used in the development process;
      2. the developer of the system, system component, or system service is required to follow a documented development process that identifies the tools used in the development process;
      1. the developer of the system, system component, or system service is required to follow a documented development process that documents the specific tool used in the development process;
      2. the developer of the system, system component, or system service is required to follow a documented development process that documents the specific tool configurations used in the development process;
    4. the developer of the system, system component, or system service is required to follow a documented development process that documents, manages, and ensures the integrity of changes to the process and/or tools used in development;
    1. the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [Assignement: frequency] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [Assignement: security requirements];
    2. the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [Assignement: frequency] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [Assignement: privacy requirements].

Assessment Method

Examine

System and services acquisition policy system and services acquisition procedures procedures addressing development process, standards, and tools procedures addressing the integration of security and privacy requirements during the development process solicitation documentation acquisition documentation critical component inventory documentation service level agreements acquisition contracts for the system, system component, or system service system developer documentation listing tool options/configuration guides configuration management policy configuration management records documentation of development process reviews using maturity models change control records configuration control records documented reviews of the development process, standards, tools, and tool options/configurations system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security and privacy responsibilities system developer

1. Übersicht

SA-15(01) Quality Metrics

Control

Require the developer of the system, system component, or system service to:
  1. Define quality metrics at the beginning of the development process; and
  2. Provide evidence of meeting the quality metrics [Selection(one-or-more): {{ insert: param, sa-15.01_odp.02 }} ; {{ insert: param, sa-15.01_odp.03 }} ; upon delivery].

Discussion

Organizations use quality metrics to establish acceptable levels of system quality. Metrics can include quality gates, which are collections of completion criteria or sufficiency standards that represent the satisfactory execution of specific phases of the system development project. For example, a quality gate may require the elimination of all compiler warnings or a determination that such warnings have no impact on the effectiveness of required security or privacy capabilities. During the execution phases of development projects, quality gates provide clear, unambiguous indications of progress. Other metrics apply to the entire development project. Metrics can include defining the severity thresholds of vulnerabilities in accordance with organizational risk tolerance, such as requiring no known vulnerabilities in the delivered system with a Common Vulnerability Scoring System (CVSS) severity of medium or high.

Assessment Objective

  1. the developer of the system, system component, or system service is required to define quality metrics at the beginning of the development process;
  2. the developer of the system, system component, or system service is required to provide evidence of meeting the quality metrics [Selection(one-or-more): {{ insert: param, sa-15.01_odp.02 }} ; {{ insert: param, sa-15.01_odp.03 }} ; upon delivery].

Assessment Method

Examine

System and services acquisition policy procedures addressing development process, standards, and tools procedures addressing the integration of security requirements into the acquisition process solicitation documentation acquisition documentation service level agreements acquisition contracts for the system, system component, or system service list of quality metrics documentation evidence of meeting quality metrics system security plan other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities system developer
SA-15(02) Security and Privacy Tracking Tools

Control

Require the developer of the system, system component, or system service to select and employ security and privacy tracking tools for use during the development process.

Discussion

System development teams select and deploy security and privacy tracking tools, including vulnerability or work item tracking systems that facilitate assignment, sorting, filtering, and tracking of completed work items or tasks associated with development processes.

Assessment Objective

  1. the developer of the system, system component, or system service is required to select and employ security tracking tools for use during the development process;
  2. the developer of the system, system component, or system service is required to select and employ privacy tracking tools for use during the development process.

Assessment Method

Examine

System and services acquisition policy system and services acquisition procedures procedures addressing development process, standards, and tools procedures addressing the integration of security and privacy requirements into the acquisition process solicitation documentation acquisition documentation service level agreements acquisition contracts for the system, system component, or system service documentation of the selection of security and privacy tracking tools evidence of employing security and privacy tracking tools system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities system developer organizational personnel with privacy responsibilities
SA-15(03) Criticality Analysis

Control

Require the developer of the system, system component, or system service to perform a criticality analysis:
  1. At the following decision points in the system development life cycle: [Assignement: decision points] ; and
  2. At the following level of rigor: [Assignement: organization-defined breadth and depth of criticality analysis].

Discussion

Criticality analysis performed by the developer provides input to the criticality analysis performed by organizations. Developer input is essential to organizational criticality analysis because organizations may not have access to detailed design documentation for system components that are developed as commercial off-the-shelf products. Such design documentation includes functional specifications, high-level designs, low-level designs, source code, and hardware schematics. Criticality analysis is important for organizational systems that are designated as high value assets. High value assets can be moderate- or high-impact systems due to heightened adversarial interest or potential adverse effects on the federal enterprise. Developer input is especially important when organizations conduct supply chain criticality analyses.

Assessment Objective

  1. the developer of the system, system component, or system service is required to perform a criticality analysis at [Assignement: decision points] in the system development life cycle;
    1. the developer of the system, system component, or system service is required to perform a criticality analysis at the following rigor level: [Assignement: breadth];
    2. the developer of the system, system component, or system service is required to perform a criticality analysis at the following rigor level: [Assignement: depth] .

Assessment Method

Examine

Supply chain risk management plan system and services acquisition policy procedures addressing development process, standards, and tools procedures addressing criticality analysis requirements for the system, system component, or system service solicitation documentation acquisition documentation service level agreements acquisition contracts for the system, system component, or system service criticality analysis documentation business impact analysis documentation software development life cycle documentation system security plan other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities organizational personnel responsible for performing criticality analysis system developer organizational personnel with supply chain risk management responsibilities
SA-15(05) Attack Surface Reduction

Control

Require the developer of the system, system component, or system service to reduce attack surfaces to [Assignement: thresholds].

Discussion

Attack surface reduction is closely aligned with threat and vulnerability analyses and system architecture and design. Attack surface reduction is a means of reducing risk to organizations by giving attackers less opportunity to exploit weaknesses or deficiencies (i.e., potential vulnerabilities) within systems, system components, and system services. Attack surface reduction includes implementing the concept of layered defenses, applying the principles of least privilege and least functionality, applying secure software development practices, deprecating unsafe functions, reducing entry points available to unauthorized users, reducing the amount of code that executes, and eliminating application programming interfaces (APIs) that are vulnerable to attacks.

Assessment Objective

the developer of the system, system component, or system service is required to reduce attack surfaces to [Assignement: thresholds].

Assessment Method

Examine

System and services acquisition policy procedures addressing development process, standards, and tools procedures addressing attack surface reduction solicitation documentation acquisition documentation service level agreements acquisition contracts for the system or system service system design documentation network diagram system configuration settings and associated documentation establishing/enforcing organization-defined thresholds for reducing attack surfaces list of restricted ports, protocols, functions, and services system security plan other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities organizational personnel responsible for attack surface reduction thresholds system developer
SA-15(06) Continuous Improvement

Control

Require the developer of the system, system component, or system service to implement an explicit process to continuously improve the development process.

Discussion

Developers of systems, system components, and system services consider the effectiveness and efficiency of their development processes for meeting quality objectives and addressing the security and privacy capabilities in current threat environments.

Assessment Objective

the developer of the system, system component, or system service is required to implement an explicit process to continuously improve the development process.

Assessment Method

Examine

System and services acquisition policy system and services acquisition procedures procedures addressing development process, standards, and tools solicitation documentation acquisition documentation service level agreements acquisition contracts for the system, system component, or system service quality goals and metrics for improving the system development process security assessments quality control reviews of system development process plans of action and milestones for improving the system development process system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security and privacy responsibilities system developer
SA-15(07) Automated Vulnerability Analysis

Control

Require the developer of the system, system component, or system service [Assignement: frequency] to:
  1. Perform an automated vulnerability analysis using [Assignement: tools];
  2. Determine the exploitation potential for discovered vulnerabilities;
  3. Determine potential risk mitigations for delivered vulnerabilities; and
  4. Deliver the outputs of the tools and results of the analysis to [Assignement: personnel or roles].

Discussion

Automated tools can be more effective at analyzing exploitable weaknesses or deficiencies in large and complex systems, prioritizing vulnerabilities by severity, and providing recommendations for risk mitigations.

Assessment Objective

  1. the developer of the system, system component, or system service is required to perform automated vulnerability analysis [Assignement: frequency] using [Assignement: tools];
  2. the developer of the system, system component, or system service is required to determine the exploitation potential for discovered vulnerabilities [Assignement: frequency];
  3. the developer of the system, system component, or system service is required to determine potential risk mitigations [Assignement: frequency] for delivered vulnerabilities;
  4. the developer of the system, system component, or system service is required to deliver the outputs of the tools and results of the analysis [Assignement: frequency] to [Assignement: personnel or roles].

Assessment Method

Examine

System and services acquisition policy procedures addressing development process, standards, and tools solicitation documentation acquisition documentation service level agreements acquisition contracts for the system, system component, or system service vulnerability analysis tools and associated documentation risk assessment reports vulnerability analysis results vulnerability mitigation reports risk mitigation strategy documentation system security plan other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities system developer organizational personnel performing automated vulnerability analysis on the system
SA-15(08) Reuse of Threat and Vulnerability Information

Control

Require the developer of the system, system component, or system service to use threat modeling and vulnerability analyses from similar systems, components, or services to inform the current development process.

Discussion

Analysis of vulnerabilities found in similar software applications can inform potential design and implementation issues for systems under development. Similar systems or system components may exist within developer organizations. Vulnerability information is available from a variety of public and private sector sources, including the NIST National Vulnerability Database.

Assessment Objective

  1. the developer of the system, system component, or system service is required to use threat modeling from similar systems, components, or services to inform the current development process;
  2. the developer of the system, system component, or system service is required to use vulnerability analyses from similar systems, components, or services to inform the current development process.

Assessment Method

Examine

System and services acquisition policy supply chain risk management plan procedures addressing development process, standards, and tools solicitation documentation acquisition documentation service level agreements acquisition contracts for the system, system component, or system service threat modeling and vulnerability analyses from similar systems, system components, or system services system security plan other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities system developer organizational personnel with supply chain risk management responsibilities
SA-15(10) Incident Response Plan

Control

Require the developer of the system, system component, or system service to provide, implement, and test an incident response plan.

Discussion

The incident response plan provided by developers may provide information not readily available to organizations and be incorporated into organizational incident response plans. Developer information may also be extremely helpful, such as when organizations respond to vulnerabilities in commercial off-the-shelf products.

Assessment Objective

  1. the developer of the system, system component, or system service is required to provide an incident response plan;
  2. the developer of the system, system component, or system service is required to implement an incident response plan;
  3. the developer of the system, system component, or system service is required to test an incident response plan.

Assessment Method

Examine

System and services acquisition policy procedures addressing incident response, standards, and tools solicitation documentation acquisition documentation service level agreements acquisition contracts for the system, system components or services acquisition documentation solicitation documentation service level agreements developer incident response plan system security plan privacy plan supply chain risk management plan other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities system developer organizational personnel with supply chain risk management responsibilities
SA-15(11) Archive System or Component

Control

Require the developer of the system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security and privacy review.

Discussion

Archiving system or system components requires the developer to retain key development artifacts, including hardware specifications, source code, object code, and relevant documentation from the development process that can provide a readily available configuration baseline for system and component upgrades or modifications.

Assessment Objective

the developer of the system or system component is required to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security and privacy review.

Assessment Method

Examine

System and services acquisition policy procedures addressing development process, standards, and tools solicitation documentation acquisition documentation service level agreements acquisition contracts for the system or system component evidence of archived system or component system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities system developer organizational personnel with privacy responsibilities
SA-15(12) Minimize Personally Identifiable Information

Control

Require the developer of the system or system component to minimize the use of personally identifiable information in development and test environments.

Discussion

Organizations can minimize the risk to an individual’s privacy by using techniques such as de-identification or synthetic data. Limiting the use of personally identifiable information in development and test environments helps reduce the level of privacy risk created by a system.

Assessment Objective

the developer of the system or system component is required to minimize the use of personally identifiable information in development and test environments.

Assessment Method

Examine

System and services acquisition policy system and services acquisition procedures procedures addressing the development process procedures addressing the minimization of personally identifiable information in testing, training, and research personally identifiable information processing policy procedures addressing the authority to test with personally identifiable information standards and tools solicitation documentation service level agreements acquisition contracts for the system or services system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with acquisition responsibilities organizational personnel with information security and privacy responsibilities system developer
SA-15(13) Logging Syntax

Control

Require the developer of the system, system component, or system service to use [Assignement: secure logging format(s)] to log [Assignement: events types to log] at [Assignement: level of detail to log].

Discussion

In support of better incident response and the ability to more quickly reconstruct security-related actions, identifying specific requirements for secure logging facilitates the ability to connect application-produced audit event logs with operational data. Event types are consistent with the event types defined in [AU-02](#au-2).

Assessment Objective

Determine if: the developer of the system, system component, or system service uses [Assignement: secure logging format(s)] to log [Assignement: events types to log] at [Assignement: level of detail to log].

Assessment Method

Examine

System and services acquisition policy; solicitation documentation; acquisition documentation; service level agreements; acquisition contracts for the system, system component, or system service; requirements for logging format, event types, and level of detail; documentation evidence of requirements for logging format, event types, and level of detail; system security plan; other relevant documents or records.

Interview

Organizational personnel with system and service acquisition responsibilities; organizational personnel with information security responsibilities; system developer

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
is blocked by SA-15 Development Process, Standards, and Tools – Assessment Procedure
is blocked by Secure Software Development Practices (SSDP)