+SA-10(04) Trusted Generation

SA-10(04) Trusted Generation

Control

Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of security-relevant hardware descriptions, source code, and object code with previous versions.

Discussion

The trusted generation of descriptions, source code, and object code addresses authorized changes to hardware, software, and firmware components between versions during development. The focus is on the efficacy of the configuration management process by the developer to ensure that newly generated versions of security-relevant hardware descriptions, source code, and object code continue to enforce the security policy for the system, system component, or system service. In contrast, [SA-10(1)](#sa-10.1) and [SA-10(3)](#sa-10.3) allow organizations to detect unauthorized changes to hardware, software, and firmware components using tools, techniques, or mechanisms provided by developers.

Assessment Objective

  1. the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of security-relevant hardware descriptions with previous versions;
  2. the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of source code with previous versions;
  3. the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of object code with previous versions.

Assessment Method

Examine

System and services acquisition policy procedures addressing system developer configuration management solicitation documentation acquisition documentation service level agreements acquisition contracts for the system, system component, or system service system developer configuration management plan change control records configuration management records configuration control audit records system security plan other relevant documents or records

Interview

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
is blocked by SA-10(04) Trusted Generation – Assessment Procedure