Assessment Objective
Determine if:
- SA-15(01)(a) the developer of the system, system component, or system service is required to define quality metrics at the beginning of the development process;
- SA-15(01)(b) the developer of the system, system component, or system service is required to provide evidence of meeting the quality metrics [Selection (one or more): [Assignment: frequency] ; [Assignment: program review] ; upon delivery].
Assessment Methods
Examine
- System and services acquisition policy
- procedures addressing development process, standards, and tools
- procedures addressing the integration of security requirements into the acquisition process
- solicitation documentation
- acquisition documentation
- service level agreements
- acquisition contracts for the system, system component, or system service
- list of quality metrics
- documentation evidence of meeting quality metrics
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system and service acquisition responsibilities
- organizational personnel with information security responsibilities
- system developer
Pedidos ligados
| Tipo de ligação | Pedido |
|---|---|
| blocks | SA-15(01) Quality Metrics |