Assessment Objective
Determine if:
- SA-21a. the developer of [Assignment: system, systems component, or system service] is required to have appropriate access authorizations as determined by assigned [Assignment: official government duties];
- SA-21b. the developer of [Assignment: system, systems component, or system service] is required to satisfy [Assignment: additional personnel screening criteria].
Assessment Methods
Examine
- System and services acquisition policy
- personnel security policy and procedures
- procedures addressing personnel screening
- system design documentation
- acquisition documentation
- service level agreements
- acquisition contracts for developer services
- system configuration settings and associated documentation
- list of appropriate access authorizations required by the developers of the system
- personnel screening criteria and associated documentation
- system security plan
- supply chain risk management plan
- other relevant documents or records
Interview
- Organizational personnel with system and service acquisition responsibilities
- organizational personnel with information security responsibilities
- organizational personnel responsible for developer screening
Test
- Organizational processes for developer screening
- mechanisms supporting developer screening
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | SA-21 [H] Developer Screening |