Assessment Objective
Determine if:
- SA-20 [Assignment: critical system] are reimplemented or custom-developed.
Assessment Methods
Examine
- Supply chain risk management plan
- system and services acquisition policy
- procedures addressing the customized development of critical system components
- system design documentation
- system configuration settings and associated documentation
- system development life cycle documentation addressing the custom development of critical system components
- configuration management records
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system and service acquisition responsibilities
- organizational personnel with information security responsibilities
- organizational personnel with responsibility for the reimplementation or customized development of critical system components
Test
- Organizational processes for the reimplementation or customized development of critical system components
- mechanisms supporting and/or implementing the reimplementation or customized development of critical system components
Incidencias vinculadas
| Tipo de vínculo | Incidencia |
|---|---|
| blocks | SA-20 Customized Development of Critical Components |