Assessment Objective
Determine if:
- SA-04(01) the developer of the system, system component, or system service is required to provide a description of the functional properties of the controls to be implemented.
Assessment Methods
Examine
- System and services acquisition policy
- system and services acquisition procedures
- procedures addressing the integration of security and privacy requirements, descriptions, and criteria into the acquisition process
- solicitation documents
- acquisition documentation
- acquisition contracts for the system, system component, or system services
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with acquisition/contracting responsibilities
- organizational personnel with information security and privacy responsibilities
- system developers
Test
- Organizational processes for determining system security functional requirements
- organizational processes for developing acquisition contracts
- mechanisms supporting and/or implementing acquisitions and the inclusion of security and privacy requirements in contracts
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | SA-04(01) [H] Functional Properties of Controls |