Assessment Objective

Determine if:

• SA-04(02) the developer of the system, system component, or system service is required to provide design and implementation information for the controls that includes using [Selection (one or more): security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; [Assignment: design and implementation information] ] at [Assignment: level of detail].

Assessment Methods

Examine

• System and services acquisition policy
• system and services acquisition procedures
• procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process
• solicitation documents
• acquisition documentation
• acquisition contracts for the system, system components, or system services
• design and implementation information for controls employed in the system, system component, or system service
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with acquisition/contracting responsibilities
• organizational personnel with the responsibility to determine system security requirements
• system developers or service provider
• organizational personnel with information security responsibilities

Test

• Organizational processes for determining the level of detail for system design and controls
• organizational processes for developing acquisition contracts
• mechanisms supporting and/or implementing the development of system design details

Συνδεδεμένα ζητήματα

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final