+SA-15 [M] Development Process, Standards, and Tools
---+SA-15(03) [M] Criticality Analysis

SA-15 [M] Development Process, Standards, and Tools

Control

  1. Require the developer of the system, system component, or system service to follow a documented development process that:
    1. Explicitly addresses security and privacy requirements;
    2. Identifies the standards and tools used in the development process;
    3. Documents the specific tool options and tool configurations used in the development process; and
    4. Documents, manages, and ensures the integrity of changes to the process and/or tools used in development; and
  2. Review the development process, standards, tools, tool options, and tool configurations [Assignement: frequency] to determine if the process, standards, tools, tool options and tool configurations selected and employed can satisfy the following security and privacy requirements: [Assignement: organization-defined security and privacy requirements].

Discussion

Development tools include programming languages and computer-aided design systems. Reviews of development processes include the use of maturity models to determine the potential effectiveness of such processes. Maintaining the integrity of changes to tools and processes facilitates effective supply chain risk assessment and mitigation. Such integrity requires configuration control throughout the system development life cycle to track authorized changes and prevent unauthorized changes.

Assessment Objective

      1. the developer of the system, system component, or system service is required to follow a documented development process that explicitly addresses security requirements;
      2. the developer of the system, system component, or system service is required to follow a documented development process that explicitly addresses privacy requirements;
      1. the developer of the system, system component, or system service is required to follow a documented development process that identifies the standards used in the development process;
      2. the developer of the system, system component, or system service is required to follow a documented development process that identifies the tools used in the development process;
      1. the developer of the system, system component, or system service is required to follow a documented development process that documents the specific tool used in the development process;
      2. the developer of the system, system component, or system service is required to follow a documented development process that documents the specific tool configurations used in the development process;
    4. the developer of the system, system component, or system service is required to follow a documented development process that documents, manages, and ensures the integrity of changes to the process and/or tools used in development;
    1. the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [Assignement: frequency] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [Assignement: security requirements];
    2. the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [Assignement: frequency] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [Assignement: privacy requirements].

Assessment Method

Examine

System and services acquisition policy system and services acquisition procedures procedures addressing development process, standards, and tools procedures addressing the integration of security and privacy requirements during the development process solicitation documentation acquisition documentation critical component inventory documentation service level agreements acquisition contracts for the system, system component, or system service system developer documentation listing tool options/configuration guides configuration management policy configuration management records documentation of development process reviews using maturity models change control records configuration control records documented reviews of the development process, standards, tools, and tool options/configurations system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security and privacy responsibilities system developer

1. Vue d’ensemble

SA-15(03) [M] Criticality Analysis

Control

Require the developer of the system, system component, or system service to perform a criticality analysis:
  1. At the following decision points in the system development life cycle: [Assignement: decision points] ; and
  2. At the following level of rigor: [Assignement: organization-defined breadth and depth of criticality analysis].

Discussion

Criticality analysis performed by the developer provides input to the criticality analysis performed by organizations. Developer input is essential to organizational criticality analysis because organizations may not have access to detailed design documentation for system components that are developed as commercial off-the-shelf products. Such design documentation includes functional specifications, high-level designs, low-level designs, source code, and hardware schematics. Criticality analysis is important for organizational systems that are designated as high value assets. High value assets can be moderate- or high-impact systems due to heightened adversarial interest or potential adverse effects on the federal enterprise. Developer input is especially important when organizations conduct supply chain criticality analyses.

Assessment Objective

  1. the developer of the system, system component, or system service is required to perform a criticality analysis at [Assignement: decision points] in the system development life cycle;
    1. the developer of the system, system component, or system service is required to perform a criticality analysis at the following rigor level: [Assignement: breadth];
    2. the developer of the system, system component, or system service is required to perform a criticality analysis at the following rigor level: [Assignement: depth] .

Assessment Method

Examine

Supply chain risk management plan system and services acquisition policy procedures addressing development process, standards, and tools procedures addressing criticality analysis requirements for the system, system component, or system service solicitation documentation acquisition documentation service level agreements acquisition contracts for the system, system component, or system service criticality analysis documentation business impact analysis documentation software development life cycle documentation system security plan other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities organizational personnel responsible for performing criticality analysis system developer organizational personnel with supply chain risk management responsibilities

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

Exigences

3. Réglementations associées

Réglementations

Tickets liés

Liens
is blocked by SA-15 [M] Development Process, Standards, and Tools – Assessment Procedure
is blocked by Secure Software Development Practices (SSDP)