+SA-08 [H] Security and Privacy Engineering Principles

SA-08 [H] Security and Privacy Engineering Principles

Control

Apply the following systems security and privacy engineering principles in the specification, design, development, implementation, and modification of the system and system components: [Assignement: organization-defined systems security and privacy engineering principles].

Discussion

Systems security and privacy engineering principles are closely related to and implemented throughout the system development life cycle (see [SA-3](#sa-3) ). Organizations can apply systems security and privacy engineering principles to new systems under development or to systems undergoing upgrades. For existing systems, organizations apply systems security and privacy engineering principles to system upgrades and modifications to the extent feasible, given the current state of hardware, software, and firmware components within those systems. The application of systems security and privacy engineering principles helps organizations develop trustworthy, secure, and resilient systems and reduces the susceptibility to disruptions, hazards, threats, and the creation of privacy problems for individuals. Examples of system security engineering principles include: developing layered protections; establishing security and privacy policies, architecture, and controls as the foundation for design and development; incorporating security and privacy requirements into the system development life cycle; delineating physical and logical security boundaries; ensuring that developers are trained on how to build secure software; tailoring controls to meet organizational needs; and performing threat modeling to identify use cases, threat agents, attack vectors and patterns, design patterns, and compensating controls needed to mitigate risk. Organizations that apply systems security and privacy engineering concepts and principles can facilitate the development of trustworthy, secure systems, system components, and system services; reduce risk to acceptable levels; and make informed risk management decisions. System security engineering principles can also be used to protect against certain supply chain risks, including incorporating tamper-resistant hardware into a design.

Assessment Objective

  1. [Assignement: systems security engineering principles] are applied in the specification of the system and system components;
  2. [Assignement: systems security engineering principles] are applied in the design of the system and system components;
  3. [Assignement: systems security engineering principles] are applied in the development of the system and system components;
  4. [Assignement: systems security engineering principles] are applied in the implementation of the system and system components;
  5. [Assignement: systems security engineering principles] are applied in the modification of the system and system components;
  6. [Assignement: privacy engineering principles] are applied in the specification of the system and system components;
  7. [Assignement: privacy engineering principles] are applied in the design of the system and system components;
  8. [Assignement: privacy engineering principles] are applied in the development of the system and system components;
  9. [Assignement: privacy engineering principles] are applied in the implementation of the system and system components;
  10. [Assignement: privacy engineering principles] are applied in the modification of the system and system components.

Assessment Method

Examine

System and services acquisition policy system and services acquisition procedures assessment and authorization procedures procedures addressing security and privacy engineering principles used in the specification, design, development, implementation, and modification of the system system design documentation security and privacy requirements and specifications for the system system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records

Interview

Organizational personnel with acquisition/contracting responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with system specification, design, development, implementation, and modification responsibilities system developers

1. Ħarsa ġenerali

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti

Kwistjonijiet marbuta

Links
is blocked by SA-08 [H] Security and Privacy Engineering Principles – Assessment Procedure
is blocked by Secure Baseline Configurations
is blocked by Secure Engineering Principles