Assessment Objective
Determine if:
- SA-04(09)[01] the developer of the system, system component, or system service is required to identify the functions intended for organizational use;
- SA-04(09)[02] the developer of the system, system component, or system service is required to identify the ports intended for organizational use;
- SA-04(09)[03] the developer of the system, system component, or system service is required to identify the protocols intended for organizational use;
- SA-04(09)[04] the developer of the system, system component, or system service is required to identify the services intended for organizational use.
Assessment Methods
Examine
- System and services acquisition policy
- procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process
- system design documentation
- system documentation, including functions, ports, protocols, and services intended for organizational use
- acquisition contracts for systems or services
- acquisition documentation
- solicitation documentation
- service level agreements
- organizational security requirements, descriptions, and criteria for developers of systems, system components, and system services
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with acquisition/contracting responsibilities
- organizational personnel with the responsibility for determining system security requirements
- system/network administrators
- organizational personnel operating, using, and/or maintaining the system
- system developers
- organizational personnel with information security responsibilities
Verknüpfte Vorgänge
| Verknüpfungstyp | Vorgang |
|---|---|
| blocks | SA-04(09) Functions, Ports, Protocols, and Services in Use |