Assessment Objective

Determine if:

• SC-38 [Assignment: operations security controls] are employed to protect key organizational information throughout the system development life cycle.

Assessment Methods

Examine

• System and communications protection policy
• procedures addressing operations security
• security plan
• list of operations security safeguards
• security control assessments
• risk assessments
• threat and vulnerability assessments
• plans of action and milestones
• system development life cycle documentation
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• organizational personnel installing, configuring, and/or maintaining the system
• system developers/integrators

Test

• Organizational processes for protecting organizational information throughout the system development life cycle
• mechanisms supporting and/or implementing safeguards to protect organizational information throughout the system development life cycle

Susietos užduotys

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final