Assessment Objective

Determine if:

• SA-04(07)(a) the use of commercially provided information assurance and information assurance-enabled information technology products is limited to those products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists;
• SA-04(07)(b) if no NIAP-approved Protection Profile exists for a specific technology type but a commercially provided information technology product relies on cryptographic functionality to enforce its security policy, that cryptographic module is required to be FIPS-validated or NSA-approved.

Assessment Methods

Examine

• Supply chain risk management plan
• system and services acquisition policy
• procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process
• solicitation documents
• acquisition documentation
• acquisition contracts for the system, system component, or system service
• list of deployed IT products/solutions
• NAIP-approved protection profiles
• FIPS-validation information for cryptographic functionality
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with acquisition/contracting responsibilities
• organizational personnel with the responsibility for determining system security requirements
• organizational personnel responsible for ensuring that information assurance products have been evaluated against a NIAP-approved protection profile or for ensuring products relying on cryptographic functionality are FIPS-validated
• organizational personnel with information security responsibilities

Test

• Organizational processes for selecting and employing products/services evaluated against a NIAP-approved protection profile or FIPS-validated products

Verknüpfte Vorgänge

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final