Assessment Objective

Determine if:

• SR-05(02)[01] the system, system component, or system service is assessed prior to selection;
• SR-05(02)[02] the system, system component, or system service is assessed prior to acceptance;
• SR-05(02)[03] the system, system component, or system service is assessed prior to modification;
• SR-05(02)[04] the system, system component, or system service is assessed prior to update.

Assessment Methods

Examine

• System security plan
• system and services acquisition policy
• procedures addressing supply chain protection
• procedures addressing the integration of information security requirements into the acquisition process
• security test and evaluation results
• vulnerability assessment results
• penetration testing results
• organizational risk assessment results
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with system and services acquisition responsibilities
• organizational personnel with information security responsibilities
• organizational personnel with supply chain protection responsibilities

Test

• Organizational processes for conducting assessments prior to selection, acceptance, or update
• mechanisms supporting and/or implementing the conducting of assessments prior to selection, acceptance, or update

Kwistjonijiet marbuta

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final