Assessment Objective
Determine if:
- SA-08(03)[01] [Assignment: systems or system components] implement the security design principle of modularity;
- SA-08(03)[02] [Assignment: systems or system components] implement the security design principle of layering.
Assessment Methods
Examine
- System and services acquisition policy
- procedures addressing the security design principles of modularity and layering used in the specification, design, development, implementation, and modification of the system
- system design documentation
- security and privacy requirements and specifications for the system
- system security and privacy architecture
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with the responsibility for determining system security and privacy requirements
- organizational personnel with system specification, design, development, implementation, and modification responsibilities
- system developers
- organizational personnel with information security responsibilities
Test
- Organizational processes for applying the security design principles of modularity and layering in system specification, design, development, implementation, and modification
- mechanisms supporting the application of the security design principles of modularity and layering in system specification, design, development, implementation, and modification
- mechanisms supporting and/or implementing an isolation boundary
Ticket collegati
| Tipo di collegamento | Ticket |
|---|---|
| blocks | SA-08(03) Modularity and Layering |