Assessment Objective
Determine if:
- SA-17(02)(a)
- SA-17(02)(a)[01] the developer of the system, system component, or system service is required to define security-relevant hardware;
- SA-17(02)(a)[02] the developer of the system, system component, or system service is required to define security-relevant software;
- SA-17(02)(a)[03] the developer of the system, system component, or system service is required to define security-relevant firmware;
- SA-17(02)(b) the developer of the system, system component, or system service is required to provide a rationale that the definition for security-relevant hardware, software, and firmware is complete.
Assessment Methods
Examine
- System and services acquisition policy
- enterprise architecture policy
- procedures addressing developer security architecture and design specifications for the system
- solicitation documentation
- acquisition documentation
- service level agreements
- acquisition contracts for the system, system component, or system service
- list of security-relevant hardware, software, and firmware components
- documented rationale of completeness regarding definitions provided for security-relevant hardware, software, and firmware
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system and service acquisition responsibilities
- organizational personnel with information security responsibilities
- system developers
- organizational personnel with information security architecture and design responsibilities
Ticket collegati
| Tipo di collegamento | Ticket |
|---|---|
| blocks | SA-17(02) Security-relevant Components |