NIST SP 800-53A

________________________________________________________________________________________________

SA-5(2) INFORMATION SYSTEM DOCUMENTATION

SA-5(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization obtains, protects as required, and makes available to authorized personnel, vendor/manufacturer documentation that describes the securityrelevant external interfaces to the information system with sufficient detail to permit analysis and testing.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing information system documentation; information system design documentation; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with information system security documentation responsibilities; organizational personnel operating, using, and/or maintaining the information system].

SA-5(3) INFORMATION SYSTEM DOCUMENTATION

SA-5(3).1 ASSESSMENT OBJECTIVE:

Determine if the organization obtains, protects as required, and makes available to authorized personnel, vendor/manufacturer documentation that describes the high-level design of the information system in terms of subsystems and implementation details of the security controls employed within the system with sufficient detail to permit analysis and testing.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing information system documentation; information system design documentation; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with information system security, acquisition, and contracting responsibilities; organizational personnel operating, using, and/or maintaining the information system].

SA-5(4) INFORMATION SYSTEM DOCUMENTATION

SA-5(4).1 ASSESSMENT OBJECTIVE:

Determine if the organization obtains, protects as required, and makes available to authorized personnel, vendor/manufacturer documentation that describes the low-level design of the information system in terms of modules and implementation details of the security controls employed within the system with sufficient detail to permit analysis and testing.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing information system documentation; information system design documentation; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with information system security documentation responsibilities; organizational personnel operating, using, and/or maintaining the information system].

________________________________________________________________________________________________

SA-5(5) INFORMATION SYSTEM DOCUMENTATION

SA-5(5).1 ASSESSMENT OBJECTIVE:

Determine if the organization obtains, protects as required, and makes available to authorized personnel, the source code for the information system to permit analysis and testing.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing information system documentation; information system design documentation; information system source code documentation; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with information system security, acquisition, and contracting responsibilities; organizational personnel operating, using, and/or maintaining the information system].

________________________________________________________________________________________________

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing software usage restrictions; site license documentation; list of software usage restrictions; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with information system administration responsibilities; organizational personnel operating, using, and/or maintaining the information system].

SA-6(1) SOFTWARE USAGE RESTRICTIONS

SA-6(1).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the organization prohibits the use of binary or machine executable code from sources with limited or no warranty without accompanying source code;

(ii)the organization provides exceptions to the source code requirement only when no alternative solutions are available to support compelling mission/operational requirements; and

(iii)the organization obtains express written consent of the authorizing official for exceptions to the source code requirement.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing the integration of information security requirements and/or security specifications into the acquisition process; solicitation documents; acquisition documentation; acquisition contracts for information systems or services; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with information system administration responsibilities; organizational personnel operating, using, and/or maintaining the information system].

________________________________________________________________________________________________

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing user installed software; list of rules governing user installed software; network traffic on the information system; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with information system administration responsibilities; organizational personnel operating, using, and/or maintaining the information system].

Test: [SELECT FROM: Enforcement of rules for user installed software on the information system; information system for prohibited software].

________________________________________________________________________________________________

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing security engineering principles used in the development and implementation of the information system; information system design documentation; security requirements and security specifications for the information system; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with information system design, development, implementation, and modification responsibilities].

________________________________________________________________________________________________

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing external information system services; acquisition contracts and service level agreements; organizational security requirements and security specifications for external provider services; security control assessment evidence from external providers of information system services; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with system and services acquisition responsibilities; external providers of information system services].

SA-9(1) SOFTWARE USAGE RESTRICTIONS

SA-9(1).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the organization conducts an organizational assessment of risk prior to the acquisition or outsourcing of dedicated information security services;

(ii)the organization defines the senior organizational official designated to approve the acquisition or outsourcing of dedicated information security services; and

(iii)the designated senior organizational official approves the acquisition or outsourcing of dedicated information security services.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing the integration of information security requirements and/or security specifications into the acquisition process; solicitation documents; acquisition documentation; acquisition contracts for information systems or services; risk assessment reports; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with information system security, acquisition, and contracting responsibilities].

________________________________________________________________________________________________

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing information system developer/integrator configuration management; acquisition contracts and service level agreements; information system developer/integrator configuration management plan; security flaw tracking records; system change authorization records; other relevant documents or records].

Interview: [SELECT FROM: Organization personnel with information system security, acquisition, and contracting responsibilities; organization personnel with configuration management responsibilities].

SA-10(1) DEVELOPER CONFIGURATION MANAGEMENT

SA-10(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization requires that information system developers/integrators provide an integrity check of software to facilitate organizational verification of software integrity after delivery.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing information system developer/integrator configuration management; acquisition contracts and service level agreements; information system developer/integrator configuration management plan; security flaw tracking records; system change authorization records; other relevant documents or records].

________________________________________________________________________________________________

SA-10(2) DEVELOPER CONFIGURATION MANAGEMENT

SA-10(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization provides an alternative configuration management process with organizational personnel in the absence of a dedicated developer/integrator configuration management team.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing information system developer/integrator configuration management; acquisition contracts and service level agreements; information system configuration management plan; security flaw tracking records; system change authorization records; other relevant documents or records].

________________________________________________________________________________________________

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing information system developer/integrator security testing; acquisition contracts and service level agreements; information system developer/integrator security test plans; records of developer/integrator security testing results for the information system; security flaw tracking records; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with developer security testing responsibilities].

SA-11(1) DEVELOPER SECURITY TESTING

SA-11(1).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the organization requires that information system developers/integrators employ code analysis tools to examine software for common flaws; and

(ii)the organization requires that information system developers/integrators document the results of the analysis.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing information system developer/integrator security testing; acquisition contracts and service level agreements; information system developer/integrator security test plans; records of developer/integrator security testing results for the information system; security flaw tracking records; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with developer security testing responsibilities].

________________________________________________________________________________________________

SA-11(2) DEVELOPER SECURITY TESTING

SA-11(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization requires that information system developers/integrators perform a vulnerability analysis to document vulnerabilities, exploitation potential, and risk mitigations.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing information system developer/integrator security testing; acquisition contracts and service level agreements; information system developer/integrator security test plans; records of developer/integrator security testing results for the information system; vulnerability scanning results; information system risk assessment report; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with developer security testing responsibilities].

SA-11(3) DEVELOPER SECURITY TESTING

SA-11(3).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the organization requires that information system developers/integrators create a security test and evaluation plan; and

(ii)the organization requires that information system developers/integrators implement the plan under the witness of an independent verification and validation agent.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing information system developer/integrator security testing; solicitation documents; acquisition documentation; acquisition contracts for information systems or services; security test and evaluation plan; security test and evaluation results report; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with information system security, acquisition, and contracting responsibilities; organizational personnel with developer security testing responsibilities; independent verification and validation agent].