+SA-04(03) Development Methods, Techniques, and Practices

SA-04(03) Development Methods, Techniques, and Practices

Control

Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes:
  1. [Assignement: systems engineering methods];
  2. [Selection(one-or-more): {{ insert: param, sa-04.03_odp.03 }} ; {{ insert: param, sa-04.03_odp.04 }} ] ; and
  3. [Selection(one-or-more): {{ insert: param, sa-04.03_odp.06 }} ; {{ insert: param, sa-04.03_odp.07 }} ; {{ insert: param, sa-04.03_odp.08 }} ].

Discussion

Following a system development life cycle that includes state-of-the-practice software development methods, systems engineering methods, systems security and privacy engineering methods, and quality control processes helps to reduce the number and severity of latent errors within systems, system components, and system services. Reducing the number and severity of such errors reduces the number of vulnerabilities in those systems, components, and services. Transparency in the methods and techniques that developers select and implement for systems engineering, systems security and privacy engineering, software development, component and system assessments, and quality control processes provides an increased level of assurance in the trustworthiness of the system, system component, or system service being acquired.

Assessment Objective

  1. the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes [Assignement: systems engineering methods];
  2. the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes [Selection(one-or-more): {{ insert: param, sa-04.03_odp.03 }} ; {{ insert: param, sa-04.03_odp.04 }} ];
  3. the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes [Selection(one-or-more): {{ insert: param, sa-04.03_odp.06 }} ; {{ insert: param, sa-04.03_odp.07 }} ; {{ insert: param, sa-04.03_odp.08 }} ].

Assessment Method

Examine

System and services acquisition policy system and services acquisition procedures procedures addressing the integration of security and privacy requirements, descriptions, and criteria into the acquisition process solicitation documents acquisition documentation acquisition contracts for the system, system component, or system service list of systems security and privacy engineering methods to be included in the developer’s system development life cycle process list of software development methods to be included in the developer’s system development life cycle process list of testing, evaluation, or validation techniques to be included in the developer’s system development life cycle process list of quality control processes to be included in the developer’s system development life cycle process system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with acquisition/contracting responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with system life cycle responsibilities system developers or service provider

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
is blocked by SA-04(03) Development Methods, Techniques, and Practices – Assessment Procedure
is blocked by Development Methods, Techniques & Processes
is blocked by Secure Software Development Practices (SSDP)