Assessment Objective
Determine if:
- SA-03(01) system pre-production environments are protected commensurate with risk throughout the system development life cycle for the system, system component, or system service.
Assessment Methods
Examine
- System and services acquisition policy
- procedures addressing the integration of security and supply chain risk management into the system development life cycle process
- system development life cycle documentation
- procedures addressing program protection planning
- criticality analysis results
- security and supply chain risk management strategy/program documentation
- system security plan
- supply chain risk management plan
- other relevant documents or records
Interview
- Organizational personnel with security and system life cycle development responsibilities
- organizational personnel with information security responsibilities
Test
- Organizational processes for defining and documenting the system development life cycle
- organizational processes for identifying system development life cycle roles and responsibilities
- organizational process for integrating security risk management into the system development life cycle
- mechanisms supporting and/or implementing the system development life cycle
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | SA-03(01) Manage Preproduction Environment |