Assessment Objective

Determine if:

• SA-04(05)(a) the developer of the system, system component, or system service is required to deliver the system, component, or service with [Assignment: security configurations] implemented;
• SA-04(05)(b) the configurations are used as the default for any subsequent system, component, or service reinstallation or upgrade.

Assessment Methods

Examine

• System and services acquisition policy
• procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process
• solicitation documents
• acquisition documentation
• acquisition contracts for the system, system component, or system service
• security configurations to be implemented by the developer of the system, system component, or system service
• service level agreements
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with acquisition/contracting responsibilities
• organizational personnel with the responsibility to determine system security requirements
• system developers or service provider
• organizational personnel with information security responsibilities

Test

• Mechanisms used to verify that the configuration of the system, component, or service is delivered as specified

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final