Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• SEA-05_A01 secure engineering principles are defined.
  Assessment rigor: 1
  Origin: 53A_R5_SA-08_ODP[01]
• SEA-05_A02 data privacy engineering principles are defined.
  Assessment rigor: 1
  Origin: 53A_R5_SA-08_ODP[02]
• SEA-05_A03 architectural designs that promote effective cybersecurity / data privacy are identified.
  Assessment rigor: 1
  Origin: 171A_3.13.2[a]
• SEA-05_A04 systems engineering principles that promote effective cybersecurity / data privacy are identified.
  Assessment rigor: 1
  Origin: 171A_3.13.2[c]
• SEA-05_A05 identified architectural designs that promote effective cybersecurity / data privacy are employed.
  Assessment rigor: 1
  Origin: 171A_3.13.2[d]
• SEA-05_A06 identified systems engineering principles that promote effective cybersecurity / data privacy are employed.
  Assessment rigor: 1
  Origin: 171A_3.13.2[f]
• SEA-05_A07 systems security engineering principles to be applied to the development or modification of the system and system components are defined.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.16.01.ODP[01]
• SEA-05_A08 systems security engineering principles are applied in the specification of the system and system components.
  Assessment rigor: 3
  Origin: 53A_R5_SA-08[01] 53A_R5_SA-08[06]
• SEA-05_A09 cybersecurity / data privacy engineering principles are applied in the design of the system and system components.
  Assessment rigor: 3
  Origin: 53A_R5_SA-08[02] 53A_R5_SA-08[07]
• SEA-05_A10 cybersecurity / data privacy engineering principles are applied in the development of the system and system components.
  Assessment rigor: 3
  Origin: 53A_R5_SA-08[03] 53A_R5_SA-08[08]
• SEA-05_A11 cybersecurity / data privacy engineering principles are applied in the implementation of the system and system components.
  Assessment rigor: 3
  Origin: 53A_R5_SA-08[04] 53A_R5_SA-08[09]
• SEA-05_A12 cybersecurity / data privacy engineering principles are applied in the modification of the system and system components.
  Assessment rigor: 3
  Origin: 53A_R5_SA-08[05] 53A_R5_SA-08[10]
• SEA-05_A13 thresholds to which attack surfaces are to be reduced are defined.
  Assessment rigor: 3
  Origin: 53A_R5_SA-15(05)_ODP
• SEA-05_A14 the developer of the system, system component, or system service is required to reduce attack surfaces to organization-defined thresholds.
  Assessment rigor: 3
  Origin: 53A_R5_SA-15(05)
• SEA-05_A15 systems are prevented from entering unsecure states in the event of an operational failure of a boundary protection device.
  Assessment rigor: 3
  Origin: 53A_R5_SC-07(18)
• SEA-05_A16 Secure Engineering & Architecture (SEA) operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
  Assessment rigor: 1
  Origin: SCF Created
• SEA-05_A17 adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support Secure Engineering & Architecture (SEA) operations.
  Assessment rigor: 1
  Origin: SCF Created
• SEA-05_A18 responsibility and authority for the performance of Secure Engineering & Architecture (SEA)-related activities are assigned to designated personnel.
  Assessment rigor: 1
  Origin: SCF Created
• SEA-05_A19 personnel performing Secure Engineering & Architecture (SEA)-related activities have the skills and knowledge needed to perform their assigned duties.
  Assessment rigor: 2
  Origin: SCF Created

Lingitud teemad

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.