Assessment Objective
Determine if:
- SA-17(05)(a) the developer of the system, system component, or system service is required to design and structure the security-relevant hardware, software, and firmware to use a complete, conceptually simple protection mechanism with precisely defined semantics;
- SA-17(05)(b) the developer of the system, system component, or system service is required to internally structure the security-relevant hardware, software, and firmware with specific regard for this mechanism.
Assessment Methods
Examine
- System and services acquisition policy
- enterprise architecture policy
- procedures addressing developer security architecture and design specifications for the system
- solicitation documentation
- acquisition documentation
- service level agreements
- acquisition contracts for the system, system component, or system service
- system design documentation
- system security architecture documentation
- system configuration settings and associated documentation
- developer documentation describing the design and structure of security-relevant hardware, software, and firmware components
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system and service acquisition responsibilities
- organizational personnel with information security responsibilities
- system developer
- organizational personnel with information security architecture and design responsibilities
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | SA-17(05) Conceptually Simple Design |