Assessment Objective

Determine if:

• SA-15(12) the developer of the system or system component is required to minimize the use of personally identifiable information in development and test environments.

Assessment Methods

Examine

• System and services acquisition policy
• system and services acquisition procedures
• procedures addressing the development process
• procedures addressing the minimization of personally identifiable information in testing, training, and research
• personally identifiable information processing policy
• procedures addressing the authority to test with personally identifiable information
• standards and tools
• solicitation documentation
• service level agreements
• acquisition contracts for the system or services
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with acquisition responsibilities
• organizational personnel with information security and privacy responsibilities
• system developer

Test

• Organizational processes for the minimization of personally identifiable information in development and test environments
• mechanisms to facilitate the minimization of personally identifiable information in development and test environments

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final