Assessment Objective
Determine if:
- SA-15(13) Determine if: the developer of the system, system component, or system service uses [Assignment: secure logging format(s)] to log [Assignment: events types to log] at [Assignment: level of detail to log].
Assessment Methods
Examine
- System and services acquisition policy;
- solicitation documentation;
- acquisition documentation;
- service level agreements;
- acquisition contracts for the system, system component, or system service;
- requirements for logging format, event types, and level of detail;
- documentation evidence of requirements for logging format, event types, and level of detail;
- system security plan; other relevant documents or records.
Interview
- Organizational personnel with system and service acquisition responsibilities;
- organizational personnel with information security responsibilities;
- system developer
Test
- Developer logs for the system, system component, or system service.
Incidencias vinculadas
| Tipo de vínculo | Incidencia |
|---|---|
| blocks | SA-15(13) Logging Syntax |