Assessment Objective
Determine if:
- SA-10a. the developer of the system, system component, or system service is required to perform configuration management during system, component, or service [Selection (one or more): design; development; implementation; operation; disposal];
- SA-10b.
- SA-10b.[01] the developer of the system, system component, or system service is required to document the integrity of changes to [Assignment: configuration items];
- SA-10b.[02] the developer of the system, system component, or system service is required to manage the integrity of changes to [Assignment: configuration items];
- SA-10b.[03] the developer of the system, system component, or system service is required to control the integrity of changes to [Assignment: configuration items];
- SA-10c. the developer of the system, system component, or system service is required to implement only organization-approved changes to the system, component, or service;
- SA-10d.
- SA-10d.[01] the developer of the system, system component, or system service is required to document approved changes to the system, component, or service;
- SA-10d.[02] the developer of the system, system component, or system service is required to document the potential security impacts of approved changes;
- SA-10d.[03] the developer of the system, system component, or system service is required to document the potential privacy impacts of approved changes;
- SA-10e.
- SA-10e.[01] the developer of the system, system component, or system service is required to track security flaws within the system, component, or service;
- SA-10e.[02] the developer of the system, system component, or system service is required to track security flaw resolutions within the system, component, or service;
- SA-10e.[03] the developer of the system, system component, or system service is required to report findings to [Assignment: personnel].
Assessment Methods
Examine
- System and services acquisition policy
- procedures addressing system developer configuration management
- solicitation documentation
- acquisition documentation
- service level agreements
- acquisition contracts for the system, system component, or system service
- system developer configuration management plan
- security flaw and flaw resolution tracking records
- system change authorization records
- change control records
- configuration management records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system and service acquisition responsibilities
- organizational personnel with information security responsibilities
- organizational personnel with configuration management responsibilities
- system developers
Test
- Organizational processes for monitoring developer configuration management
- mechanisms supporting and/or implementing the monitoring of developer configuration management
Pedidos ligados
| Tipo de ligação | Pedido |
|---|---|
| blocks | SA-10 [H] Developer Configuration Management |