Assessment Objective
Determine if:
- SA-15(02)[01] the developer of the system, system component, or system service is required to select and employ security tracking tools for use during the development process;
- SA-15(02)[02] the developer of the system, system component, or system service is required to select and employ privacy tracking tools for use during the development process.
Assessment Methods
Examine
- System and services acquisition policy
- system and services acquisition procedures
- procedures addressing development process, standards, and tools
- procedures addressing the integration of security and privacy requirements into the acquisition process
- solicitation documentation
- acquisition documentation
- service level agreements
- acquisition contracts for the system, system component, or system service
- documentation of the selection of security and privacy tracking tools
- evidence of employing security and privacy tracking tools
- system security plan
- privacy plan
- privacy impact assessment
- privacy risk assessment documentation
- other relevant documents or records
Interview
- Organizational personnel with system and service acquisition responsibilities
- organizational personnel with information security responsibilities
- system developer
- organizational personnel with privacy responsibilities
Prepojené úlohy
| Typ prepojenia | Úloha |
|---|---|
| blocks | SA-15(02) Security and Privacy Tracking Tools |