PW.2.1 Have 1) a qualified person (or people) who were not involved with the design and/or 2) automated processes instantiated in the toolchain review the …

Statement

Have 1) a qualified person (or people) who were not involved with the design and/or 2) automated processes instantiated in the toolchain review the software design to confirm and enforce that it meets all of the security requirements and satisfactorily addresses the identified risk information.

Example 1:

Review the software design to confirm that it addresses applicable security requirements.

Example 2:

Review the risk models created during software design to determine if they appear to adequately identify the risks.

Example 3:

Review the software design to confirm that it satisfactorily addresses the risks identified by the risk models.

Example 4:

Have the software’s designer correct failures to meet the requirements.

Example 5:

Change the design and/or the risk response strategy if the security requirements cannot be met.

Example 6:

Record the findings of design reviews to serve as artifacts (e.g., in the software specification, in the issue tracking system, in the threat model).

1. Ülevaade

1.1 Viited

1.2 Tuvastatud nõuded

1.3 Seotud regulatsioonid

2. Tuvastatud nõuded

3. Seotud regulatsioonid

Lingitud teemad

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final