+SA-03(03) Technology Refresh
|
SA-03(03) Technology Refresh
Control
Plan for and implement a technology refresh schedule for the system throughout the system development life cycle.
Discussion
Technology refresh planning may encompass hardware, software, firmware, processes, personnel skill sets, suppliers, service providers, and facilities. The use of obsolete or nearing obsolete technology may increase the security and privacy risks associated with unsupported components, counterfeit or repurposed components, components unable to implement security or privacy requirements, slow or inoperable components, components from untrusted sources, inadvertent personnel error, or increased complexity. Technology refreshes typically occur during the operations and maintenance stage of the system development life cycle.
Assessment Objective
- a technology refresh schedule is planned for the system throughout the system development life cycle;
- a technology refresh schedule is implemented for the system throughout the system development life cycle.
Assessment Method
Examine
System and services acquisition policy
system and services acquisition procedures
procedures addressing technology refresh planning and implementation
system development life cycle documentation
technology refresh schedule
security risk assessment documentation
privacy impact assessment
privacy risk assessment documentation
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with information security and privacy responsibilities
organizational personnel with system life cycle development responsibilities
1. Ħarsa ġenerali
1.1 Referenzi
1.2 Rekwiżiti identifikati
1.3 Regolamenti relatati
2. Rekwiżiti identifikati
3. Regolamenti relatati
Regolamenti
| Sors |
Regolamentazzjoni |
Kwistjonijiet marbuta
|