+SA-04(02) [H] Design and Implementation Information for Controls
|
SA-04(02) [H] Design and Implementation Information for Controls
Control
Require the developer of the system, system component, or system service to provide design and implementation information for the controls that includes: [Selection(one-or-more): security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; {{ insert: param, sa-04.02_odp.02 }} ] at [Assignement: level of detail].
Discussion
Organizations may require different levels of detail in the documentation for the design and implementation of controls in organizational systems, system components, or system services based on mission and business requirements, requirements for resiliency and trustworthiness, and requirements for analysis and testing. Systems can be partitioned into multiple subsystems. Each subsystem within the system can contain one or more modules. The high-level design for the system is expressed in terms of subsystems and the interfaces between subsystems providing security-relevant functionality. The low-level design for the system is expressed in terms of modules and the interfaces between modules providing security-relevant functionality. Design and implementation documentation can include manufacturer, version, serial number, verification hash signature, software libraries used, date of purchase or download, and the vendor or download source. Source code and hardware schematics are referred to as the implementation representation of the system.
Assessment Objective
the developer of the system, system component, or system service is required to provide design and implementation information for the controls that includes using [Selection(one-or-more): security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; {{ insert: param, sa-04.02_odp.02 }} ] at [Assignement: level of detail].
Assessment Method
Examine
System and services acquisition policy
system and services acquisition procedures
procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process
solicitation documents
acquisition documentation
acquisition contracts for the system, system components, or system services
design and implementation information for controls employed in the system, system component, or system service
system security plan
other relevant documents or records
Interview
Organizational personnel with acquisition/contracting responsibilities
organizational personnel with the responsibility to determine system security requirements
system developers or service provider
organizational personnel with information security responsibilities
1. Pregled
1.1 Reference
1.2 Utvrđeni zahtjevi
1.3 Povezani propisi
2. Utvrđeni zahtjevi
3. Povezani propisi
Povezani zadaci
|