Assessment Objective
Determine if:
- SA-08(24)[01] [Assignment: systems or system components] implement the security design principle of secure failure;
- SA-08(24)[02] [Assignment: systems or system components] implement the security design principle of secure recovery.
Assessment Methods
Examine
- System and services acquisition policy
- system and communications protection policy
- contingency planning policy
- procedures addressing information system recovery and reconstitution
- procedures addressing the security design principle of secure failure and recovery used in the specification, design, development, implementation, and modification of the system
- contingency plan
- procedures addressing system backup
- contingency plan test documentation
- contingency plan test results
- system design documentation
- security and privacy requirements and specifications for the system
- system security and privacy architecture
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with the responsibility for determining system security and privacy requirements
- organizational personnel with system specification, design, development, implementation, and modification responsibilities
- organizational personnel with contingency plan testing responsibilities
- organizational personnel with system recovery and reconstitution responsibilities
- system developers
- organizational personnel with information security responsibilities
- organizational personnel with information system backup responsibilities
Test
- Organizational processes for applying the security design principle of secure failure and recovery in system specification, design, development, implementation, and modification
- mechanisms supporting the application of the security design principle of secure failure and recovery in system specification, design, development, implementation, and modification
- mechanisms supporting and/or implementing secure failure
- organizational processes for contingency plan testing
- mechanisms supporting contingency plan testing
- mechanisms supporting recovery and reconstitution of the system
- organizational processes for conducting system backups
- mechanisms supporting and/or implementing system backups
Susietos užduotys
| Saito tipas | Užduotis |
|---|---|
| blocks | SA-08(24) Secure Failure and Recovery |