Assessment Objective
Determine if:
- SA-04(03)(a) the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes [Assignment: systems engineering methods];
- SA-04(03)(b) the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes [Selection (one or more): [Assignment: system security engineering methods] ; [Assignment: privacy engineering methods] ];
- SA-04(03)(c) the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes [Selection (one or more): [Assignment: software development methods] ; [Assignment: testing, evaluation, assessment, verification, and validation methods] ; [Assignment: quality control processes] ].
Assessment Methods
Examine
- System and services acquisition policy
- system and services acquisition procedures
- procedures addressing the integration of security and privacy requirements, descriptions, and criteria into the acquisition process
- solicitation documents
- acquisition documentation
- acquisition contracts for the system, system component, or system service
- list of systems security and privacy engineering methods to be included in the developer’s system development life cycle process
- list of software development methods to be included in the developer’s system development life cycle process
- list of testing, evaluation, or validation techniques to be included in the developer’s system development life cycle process
- list of quality control processes to be included in the developer’s system development life cycle process
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with acquisition/contracting responsibilities
- organizational personnel with information security and privacy responsibilities
- organizational personnel with system life cycle responsibilities
- system developers or service provider
Test
- Organizational processes for development methods, techniques, and processes
Ticket collegati
| Tipo di collegamento | Ticket |
|---|---|
| blocks | SA-04(03) Development Methods, Techniques, and Practices |