Assessment Objective
Determine if:
- SA-17(a)
- SA-17(a)[01] the developer of the system, system component, or system service is required to produce a design specification and security architecture that are consistent with the organization’s security architecture, which is an integral part the organization’s enterprise architecture;
- SA-17(a)[02] the developer of the system, system component, or system service is required to produce a design specification and privacy architecture that are consistent with the organization’s privacy architecture, which is an integral part the organization’s enterprise architecture;
- SA-17(b)
- SA-17(b)[01] the developer of the system, system component, or system service is required to produce a design specification and security architecture that accurately and completely describe the required security functionality and the allocation of controls among physical and logical components;
- SA-17(b)[02] the developer of the system, system component, or system service is required to produce a design specification and privacy architecture that accurately and completely describe the required privacy functionality and the allocation of controls among physical and logical components;
- SA-17(c)
- SA-17(c)[01] the developer of the system, system component, or system service is required to produce a design specification and security architecture that express how individual security functions, mechanisms, and services work together to provide required security capabilities and a unified approach to protection;
- SA-17(c)[02] the developer of the system, system component, or system service is required to produce a design specification and privacy architecture that express how individual privacy functions, mechanisms, and services work together to provide required privacy capabilities and a unified approach to protection.
Assessment Methods
Examine
- System and services acquisition policy
- system and services acquisition procedures
- enterprise architecture policy
- enterprise architecture documentation
- procedures addressing developer security and privacy architecture and design specifications for the system
- solicitation documentation
- acquisition documentation
- service level agreements
- acquisition contracts for the system, system component, or system service
- system design documentation
- information system configuration settings and associated documentation
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with acquisition responsibilities
- organizational personnel with information security and privacy responsibilities
- system developer
Länkade ärenden
| Länktyp | Ärende |
|---|---|
| blocks | SA-17 Developer Security and Privacy Architecture and Design |