+SA-03(01) Manage Preproduction Environment
|
SA-03(01) Manage Preproduction Environment
Control
Protect system preproduction environments commensurate with risk throughout the system development life cycle for the system, system component, or system service.
Discussion
The preproduction environment includes development, test, and integration environments. The program protection planning processes established by the Department of Defense are examples of managing the preproduction environment for defense contractors. Criticality analysis and the application of controls on developers also contribute to a more secure system development environment.
Assessment Objective
system pre-production environments are protected commensurate with risk throughout the system development life cycle for the system, system component, or system service.
Assessment Method
Examine
System and services acquisition policy
procedures addressing the integration of security and supply chain risk management into the system development life cycle process
system development life cycle documentation
procedures addressing program protection planning
criticality analysis results
security and supply chain risk management strategy/program documentation
system security plan
supply chain risk management plan
other relevant documents or records
Interview
Organizational personnel with security and system life cycle development responsibilities
organizational personnel with information security responsibilities
1. Prezentare generală
1.1 Referințe
1.2 Cerințe identificate
1.3 Reglementări asociate
2. Cerințe identificate
3. Reglementări asociate
Reglementări
| Sursă |
Reglementare |
Tichete legate
|