Assessment Objective
Determine if:
- SA-03a.
- SA-03a.[01] the system is acquired, developed, and managed using [Assignment: system-development life cycle] that incorporates information security considerations;
- SA-03a.[02] the system is acquired, developed, and managed using [Assignment: system-development life cycle] that incorporates privacy considerations;
- SA-03b.
- SA-03b.[01] information security roles and responsibilities are defined and documented throughout the system development life cycle;
- SA-03b.[02] privacy roles and responsibilities are defined and documented throughout the system development life cycle;
- SA-03c.
- SA-03c.[01] individuals with information security roles and responsibilities are identified;
- SA-03c.[02] individuals with privacy roles and responsibilities are identified;
- SA-03d.
- SA-03d.[01] organizational information security risk management processes are integrated into system development life cycle activities;
- SA-03d.[02] organizational privacy risk management processes are integrated into system development life cycle activities.
Assessment Methods
Examine
- System and services acquisition policy
- system and services acquisition procedures
- procedures addressing the integration of information security and privacy and supply chain risk management into the system development life cycle process
- system development life cycle documentation
- organizational risk management strategy
- information security and privacy risk management strategy documentation
- system security plan
- privacy plan
- privacy program plan
- enterprise architecture documentation
- role-based security and privacy training program documentation
- data mapping documentation
- other relevant documents or records
Interview
- Organizational personnel with information security and privacy responsibilities
- organizational personnel with system life cycle development responsibilities
- organizational personnel with supply chain risk management responsibilities
Test
- Organizational processes for defining and documenting the system development life cycle
- organizational processes for identifying system development life cycle roles and responsibilities
- organizational processes for integrating information security and privacy and supply chain risk management into the system development life cycle
- mechanisms supporting and/or implementing the system development life cycle
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | SA-03 System Development Life Cycle |