+SA-04(03) Development Methods, Techniques, and Practices

SA-04(03) Development Methods, Techniques, and Practices

Control

Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes:
  1. [Assignement: systems engineering methods];
  2. [Selection(one-or-more): {{ insert: param, sa-04.03_odp.03 }} ; {{ insert: param, sa-04.03_odp.04 }} ] ; and
  3. [Selection(one-or-more): {{ insert: param, sa-04.03_odp.06 }} ; {{ insert: param, sa-04.03_odp.07 }} ; {{ insert: param, sa-04.03_odp.08 }} ].

Discussion

Following a system development life cycle that includes state-of-the-practice software development methods, systems engineering methods, systems security and privacy engineering methods, and quality control processes helps to reduce the number and severity of latent errors within systems, system components, and system services. Reducing the number and severity of such errors reduces the number of vulnerabilities in those systems, components, and services. Transparency in the methods and techniques that developers select and implement for systems engineering, systems security and privacy engineering, software development, component and system assessments, and quality control processes provides an increased level of assurance in the trustworthiness of the system, system component, or system service being acquired.

Assessment Objective

  1. the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes [Assignement: systems engineering methods];
  2. the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes [Selection(one-or-more): {{ insert: param, sa-04.03_odp.03 }} ; {{ insert: param, sa-04.03_odp.04 }} ];
  3. the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes [Selection(one-or-more): {{ insert: param, sa-04.03_odp.06 }} ; {{ insert: param, sa-04.03_odp.07 }} ; {{ insert: param, sa-04.03_odp.08 }} ].

Assessment Method

Examine

System and services acquisition policy system and services acquisition procedures procedures addressing the integration of security and privacy requirements, descriptions, and criteria into the acquisition process solicitation documents acquisition documentation acquisition contracts for the system, system component, or system service list of systems security and privacy engineering methods to be included in the developer’s system development life cycle process list of software development methods to be included in the developer’s system development life cycle process list of testing, evaluation, or validation techniques to be included in the developer’s system development life cycle process list of quality control processes to be included in the developer’s system development life cycle process system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with acquisition/contracting responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with system life cycle responsibilities system developers or service provider

1. Ħarsa ġenerali

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti

Kwistjonijiet marbuta

Links
is blocked by SA-04(03) Development Methods, Techniques, and Practices – Assessment Procedure
is blocked by Development Methods, Techniques & Processes
is blocked by Secure Software Development Practices (SSDP)
  • NIST -

    EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

    DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.