Assessment Objective

Determine if:

• SA-04(08) the developer of the system, system component, or system service is required to produce a plan for the continuous monitoring of control effectiveness that is consistent with the continuous monitoring program of the organization.

Assessment Methods

Examine

• System and services acquisition policy
• procedures addressing developer continuous monitoring plans
• procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process
• developer continuous monitoring plans
• security assessment plans
• acquisition contracts for the system, system component, or system service
• acquisition documentation
• solicitation documentation
• service level agreements
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with acquisition/contracting responsibilities
• organizational personnel with the responsibility for determining system security requirements
• system developers
• organizational personnel with information security responsibilities

Test

• Vendor processes for continuous monitoring
• mechanisms supporting and/or implementing developer continuous monitoring

Tichete legate

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final