Assessment Objective

Determine if:

• SA-10(04)[01] the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of security-relevant hardware descriptions with previous versions;
• SA-10(04)[02] the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of source code with previous versions;
• SA-10(04)[03] the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of object code with previous versions.

Assessment Methods

Examine

• System and services acquisition policy
• procedures addressing system developer configuration management
• solicitation documentation
• acquisition documentation
• service level agreements
• acquisition contracts for the system, system component, or system service
• system developer configuration management plan
• change control records
• configuration management records
• configuration control audit records
• system security plan
• other relevant documents or records

Test

• Organizational processes for monitoring developer configuration management
• mechanisms supporting and/or implementing the monitoring of developer configuration management

Länkade ärenden

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final