Custom software is [software](http://en.wikipedia.org/wiki/Software)
developed either for a specific organization or function that differs
from other already available software. It is generally not targeted to
the [mass market](http://en.wikipedia.org/wiki/Mass_marketing) but
rather is usually created for specific companies, business entities, and
organizations.

+---+----------------------------------+-------------+------+---------+
| \ | Question                         | Evidence    | Prio | Score   |
| # |                                  |             | rity |         |
|   |                                  |             |      | (1-4)   |
|   |                                  |             | (    |         |
|   |                                  |             | 1-5) |         |
+===+==================================+=============+======+=========+
| S |                                  |             |      |         |
| o |                                  |             |      |         |
| f |                                  |             |      |         |
| t |                                  |             |      |         |
| w |                                  |             |      |         |
| a |                                  |             |      |         |
| r |                                  |             |      |         |
| e |                                  |             |      |         |
| H |                                  |             |      |         |
| i |                                  |             |      |         |
| s |                                  |             |      |         |
| t |                                  |             |      |         |
| o |                                  |             |      |         |
| r |                                  |             |      |         |
| y |                                  |             |      |         |
| a |                                  |             |      |         |
| n |                                  |             |      |         |
| d |                                  |             |      |         |
| L |                                  |             |      |         |
| i |                                  |             |      |         |
| c |                                  |             |      |         |
| e |                                  |             |      |         |
| n |                                  |             |      |         |
| s |                                  |             |      |         |
| e |                                  |             |      |         |
| s |                                  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 1 | Can the software pedigree be     |             | 2    | 1       |
|   | established? What is known of    |             |      |         |
|   | the people and processes that    |             |      |         |
|   | created the software (brief      |             |      |         |
|   | summary response)?               |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 2 | Is there a change management     |             | 2    | 2       |
|   | procedure or document that will  |             |      |         |
|   | identify the type and extent of  |             |      |         |
|   | changes conducted on the         |             |      |         |
|   | software throughout its          |             |      |         |
|   | lifecycle?                       |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 3 | What assurances are provided     |             | 3    | 3       |
|   | that the software does not       |             |      |         |
|   | infringe upon any copyright or   |             |      |         |
|   | patent?                          |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 4 | Does your company have corporate |             | 4    |         |
|   | policies and management controls |             |      |         |
|   | in place to ensure that only     |             |      |         |
|   | corporate-approved (licensed and |             |      |         |
|   | vetted) software components are  |             |      |         |
|   | used during the development      |             |      |         |
|   | process? Will the supplier       |             |      |         |
|   | indemnify the Acquirer from      |             |      |         |
|   | these issues in the license      |             |      |         |
|   | agreement?                       |             |      |         |
+---+----------------------------------+-------------+------+---------+
| D |                                  |             |      |         |
| e |                                  |             |      |         |
| v |                                  |             |      |         |
| e |                                  |             |      |         |
| l |                                  |             |      |         |
| o |                                  |             |      |         |
| p |                                  |             |      |         |
| m |                                  |             |      |         |
| e |                                  |             |      |         |
| n |                                  |             |      |         |
| t |                                  |             |      |         |
| P |                                  |             |      |         |
| r |                                  |             |      |         |
| o |                                  |             |      |         |
| c |                                  |             |      |         |
| e |                                  |             |      |         |
| s |                                  |             |      |         |
| s |                                  |             |      |         |
| M |                                  |             |      |         |
| a |                                  |             |      |         |
| n |                                  |             |      |         |
| a |                                  |             |      |         |
| g |                                  |             |      |         |
| e |                                  |             |      |         |
| m |                                  |             |      |         |
| e |                                  |             |      |         |
| n |                                  |             |      |         |
| t |                                  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 6 | What are the processes (e.g.,    |             | 1    |         |
|   | ISO 9000, CMMi), methods, tools  |             |      |         |
|   | (e.g., IDEs, compilers)          |             |      |         |
|   | techniques, etc. used to produce |             |      |         |
|   | and transform the software       |             |      |         |
|   | (brief summary response)?        |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 6 | What security measurement        |             | 1    |         |
|   | practices and data does your     |             |      |         |
|   | company use to assist project    |             |      |         |
|   | planning?                        |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 7 | Is software assurance considered |             |      |         |
|   | in all phases of development?    |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 8 | How is software risk managed?    |             | 2    |         |
|   | Are anticipated threats          |             |      |         |
|   | identified, assessed, and        |             |      |         |
|   | prioritized?                     |             |      |         |
+---+----------------------------------+-------------+------+---------+
| S |                                  |             |      |         |
| o |                                  |             |      |         |
| f |                                  |             |      |         |
| t |                                  |             |      |         |
| w |                                  |             |      |         |
| a |                                  |             |      |         |
| r |                                  |             |      |         |
| e |                                  |             |      |         |
| S |                                  |             |      |         |
| e |                                  |             |      |         |
| c |                                  |             |      |         |
| u |                                  |             |      |         |
| r |                                  |             |      |         |
| i |                                  |             |      |         |
| t |                                  |             |      |         |
| y |                                  |             |      |         |
| T |                                  |             |      |         |
| r |                                  |             |      |         |
| a |                                  |             |      |         |
| i |                                  |             |      |         |
| n |                                  |             |      |         |
| i |                                  |             |      |         |
| n |                                  |             |      |         |
| g |                                  |             |      |         |
| a |                                  |             |      |         |
| n |                                  |             |      |         |
| d |                                  |             |      |         |
| A |                                  |             |      |         |
| w |                                  |             |      |         |
| a |                                  |             |      |         |
| r |                                  |             |      |         |
| e |                                  |             |      |         |
| n |                                  |             |      |         |
| e |                                  |             |      |         |
| s |                                  |             |      |         |
| s |                                  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 9 | What training does your company  |             | 2    |         |
|   | offer related to defining        |             |      |         |
|   | security requirements, secure    |             |      |         |
|   | architecture and design, secure  |             |      |         |
|   | coding practices, and security   |             |      |         |
|   | testing?                         |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 1 | Do you have developers that      |             | 2    |         |
| 0 | possess software security        |             |      |         |
|   | related certifications (e.g.,    |             |      |         |
|   | the SANS secure coding           |             |      |         |
|   | certifications)?                 |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 1 | Describe the company's policy    |             | 3    |         |
| 1 | and process for professional     |             |      |         |
|   | certifications and for ensuring  |             |      |         |
|   | certifications are valid and     |             |      |         |
|   | up-to-date.                      |             |      |         |
+---+----------------------------------+-------------+------+---------+
| C |                                  |             |      |         |
| o |                                  |             |      |         |
| n |                                  |             |      |         |
| c |                                  |             |      |         |
| e |                                  |             |      |         |
| p |                                  |             |      |         |
| t |                                  |             |      |         |
| a |                                  |             |      |         |
| n |                                  |             |      |         |
| d |                                  |             |      |         |
| P |                                  |             |      |         |
| l |                                  |             |      |         |
| a |                                  |             |      |         |
| n |                                  |             |      |         |
| n |                                  |             |      |         |
| i |                                  |             |      |         |
| n |                                  |             |      |         |
| g |                                  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 1 | Are there some requirements for  |             | 1    |         |
| 2 | security that are "structured"   |             |      |         |
|   | as part of general releasability |             |      |         |
|   | of an application and others     |             |      |         |
|   | that are "as needed" or "custom" |             |      |         |
|   | for a particular release?        |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 1 | Are there some requirements for  |             | 1    |         |
| 3 | quality that are "structured" as |             |      |         |
|   | part of general releasability of |             |      |         |
|   | an application and others that   |             |      |         |
|   | are "as needed" or "custom" for  |             |      |         |
|   | a particular release?            |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 1 | What review processes are        |             | 1    |         |
| 4 | implemented to ensure that       |             |      |         |
|   | nonfunctional requirements are   |             |      |         |
|   | unambiguous, traceabl,e and      |             |      |         |
|   | testable throughout the entire   |             |      |         |
|   | SDLC?                            |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 1 | Are security requirements        |             | 3    |         |
| 5 | developed independently of the   |             |      |         |
|   | rest of the requirements         |             |      |         |
|   | engineering activities, or are   |             |      |         |
|   | they integrated into the         |             |      |         |
|   | mainstream requirements          |             |      |         |
|   | activities?                      |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 1 | Are misuse/abuse cases derived   |             | 3    |         |
| 6 | from the application             |             |      |         |
|   | requirements? Are relevant       |             |      |         |
|   | attack patterns used to identify |             |      |         |
|   | and document potential threats?  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 1 | What tool(s) does your company   |             | 3    |         |
| 7 | use for requirements management? |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 1 | If an agile development method   |             | 3    |         |
| 8 | is used, how formally are        |             |      |         |
|   | requirements documented?         |             |      |         |
+---+----------------------------------+-------------+------+---------+
| A |                                  |             |      |         |
| r |                                  |             |      |         |
| c |                                  |             |      |         |
| h |                                  |             |      |         |
| i |                                  |             |      |         |
| t |                                  |             |      |         |
| e |                                  |             |      |         |
| c |                                  |             |      |         |
| t |                                  |             |      |         |
| u |                                  |             |      |         |
| r |                                  |             |      |         |
| e |                                  |             |      |         |
| a |                                  |             |      |         |
| n |                                  |             |      |         |
| d |                                  |             |      |         |
| D |                                  |             |      |         |
| e |                                  |             |      |         |
| s |                                  |             |      |         |
| i |                                  |             |      |         |
| g |                                  |             |      |         |
| n |                                  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 1 | What threat modeling process, if |             | 2    |         |
| 9 | any, is used when designing the  |             |      |         |
|   | software protections?            |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 2 | What analysis, design, and       |             | 2    |         |
| 0 | construction tools are used by   |             |      |         |
|   | your software design teams?      |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 2 | What security design and         |             | 2    |         |
| 1 | security architecture documents  |             |      |         |
|   | are prepared as part of the SDLC |             |      |         |
|   | process? How are they            |             |      |         |
|   | maintained? Are they available   |             |      |         |
|   | to\\\\for review?                |             |      |         |
+---+----------------------------------+-------------+------+---------+
| S |                                  |             |      |         |
| o |                                  |             |      |         |
| f |                                  |             |      |         |
| t |                                  |             |      |         |
| w |                                  |             |      |         |
| a |                                  |             |      |         |
| r |                                  |             |      |         |
| e |                                  |             |      |         |
| D |                                  |             |      |         |
| e |                                  |             |      |         |
| v |                                  |             |      |         |
| e |                                  |             |      |         |
| l |                                  |             |      |         |
| o |                                  |             |      |         |
| p |                                  |             |      |         |
| m |                                  |             |      |         |
| e |                                  |             |      |         |
| n |                                  |             |      |         |
| t |                                  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 2 | What languages and               |             | 2    |         |
| 2 | non-developmental components are |             |      |         |
|   | used to produce the software     |             |      |         |
|   | (brief summary response)?        |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 2 | Does your company have formal    |             | 2    |         |
| 3 | coding standards for each        |             |      |         |
|   | language in use? If yes, how are |             |      |         |
|   | they enforced? How often are     |             |      |         |
|   | these standards and practices    |             |      |         |
|   | reviewed and revised?            |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 2 | Does the software development    |             | 1    |         |
| 4 | plan include security peer       |             |      |         |
|   | reviews?                         |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 2 | Are tools provided to help       |             | 3    |         |
| 5 | developers verify that the       |             |      |         |
|   | software they have produced      |             |      |         |
|   | software that is minimized of    |             |      |         |
|   | weaknesses that could lead to    |             |      |         |
|   | exploitable vulnerabilities?     |             |      |         |
|   | What is the breadth of common    |             |      |         |
|   | software weaknesses covered      |             |      |         |
|   | (e.g., specific CWEs)?           |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 2 | Does your organization           |             | 2    |         |
| 6 | incorporate security risk        |             |      |         |
|   | management activities as part of |             |      |         |
|   | your software development        |             |      |         |
|   | methodology? If yes, please      |             |      |         |
|   | provide a copy of the            |             |      |         |
|   | documentation of this            |             |      |         |
|   | methodology or provide           |             |      |         |
|   | information on how to obtain it  |             |      |         |
|   | from a publicly accessible       |             |      |         |
|   | source.                          |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 2 | Does your organization establish |             | 3    |         |
| 7 | contractually binding agreements |             |      |         |
|   | with their own developers and/or |             |      |         |
|   | with their third-party           |             |      |         |
|   | developers regarding the         |             |      |         |
|   | ownership and/or licensing of    |             |      |         |
|   | intellectual property?           |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 2 | Does the software use            |             | 4    |         |
| 8 | closed-source Application        |             |      |         |
|   | Programming Interfaces (APIs)    |             |      |         |
|   | that have undocumented           |             |      |         |
|   | functions?                       |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 2 | Are there contractual recourses  |             | 4    |         |
| 9 | that the organization can take   |             |      |         |
|   | if a third-party developer       |             |      |         |
|   | delivers software that contains  |             |      |         |
|   | malicious code?                  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 3 | Does the organization ever       |             | 2    |         |
| 0 | perform site inspections/policy  |             |      |         |
|   | compliance audits of its U.S.    |             |      |         |
|   | development facilities? Of its   |             |      |         |
|   | non-U.S. facilities? Of the      |             |      |         |
|   | facilities of its third-party    |             |      |         |
|   | developers? If yes, how often do |             |      |         |
|   | these inspections/audits occur?  |             |      |         |
|   | Are they periodic or triggered   |             |      |         |
|   | by events (or both)? If          |             |      |         |
|   | triggered by events, provide     |             |      |         |
|   | examples of "trigger" events.    |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 3 | In preparation for release, are  |             | 2    |         |
| 1 | undocumented functions in the    |             |      |         |
|   | software disabled, test/debug    |             |      |         |
|   | code removed, and source code    |             |      |         |
|   | comments sanitized?              |             |      |         |
+---+----------------------------------+-------------+------+---------+
| B |                                  |             |      |         |
| u |                                  |             |      |         |
| i |                                  |             |      |         |
| l |                                  |             |      |         |
| t |                                  |             |      |         |
| - |                                  |             |      |         |
| i |                                  |             |      |         |
| n |                                  |             |      |         |
| S |                                  |             |      |         |
| o |                                  |             |      |         |
| f |                                  |             |      |         |
| t |                                  |             |      |         |
| w |                                  |             |      |         |
| a |                                  |             |      |         |
| r |                                  |             |      |         |
| e |                                  |             |      |         |
| D |                                  |             |      |         |
| e |                                  |             |      |         |
| f |                                  |             |      |         |
| e |                                  |             |      |         |
| n |                                  |             |      |         |
| s |                                  |             |      |         |
| e |                                  |             |      |         |
| s |                                  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 3 | Does the software validate       |             | 3    |         |
| 2 | (e.g., filter with whitelisting) |             |      |         |
|   | inputs from untrusted sources    |             |      |         |
|   | before being used?               |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 3 | Has the software been designed   |             | 2    |         |
| 3 | to execute within a constrained  |             |      |         |
|   | execution environment (e.g.,     |             |      |         |
|   | virtual machine, sandbox, chroot |             |      |         |
|   | jail, single-purpose             |             |      |         |
|   | pseudo-user) and is it designed  |             |      |         |
|   | to isolate and minimize the      |             |      |         |
|   | extent of damage possible by a   |             |      |         |
|   | successful attack?               |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 3 | How does the software's          |             | 2    |         |
| 4 | exception handling mechanism     |             |      |         |
|   | prevent faults from leaving the  |             |      |         |
|   | software, its resources, and its |             |      |         |
|   | data (in memory and on disk) in  |             |      |         |
|   | a vulnerable state?              |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 3 | Does the exception-handling      |             | 3    |         |
| 5 | mechanism provide more than one  |             |      |         |
|   | option for responding to a       |             |      |         |
|   | fault? If so, can the            |             |      |         |
|   | exception-handling options be    |             |      |         |
|   | configured by the administrator  |             |      |         |
|   | or overridden?                   |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 3 | Does the documentation explain   |             | 3    |         |
| 6 | how to install, configure,       |             |      |         |
|   | and/or use it securely? Does it  |             |      |         |
|   | identify options that should not |             |      |         |
|   | normally be used because they    |             |      |         |
|   | create security weaknesses?      |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 3 | Where applicable, does the       |             | 3    |         |
| 7 | program use run-time             |             |      |         |
|   | infrastructure defenses (such as |             |      |         |
|   | address space randomization,     |             |      |         |
|   | stack overflow protection,       |             |      |         |
|   | preventing execution from data   |             |      |         |
|   | memory, and taint checking)?     |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 3 | How do you minimize the threat   |             | 3    |         |
| 8 | of reverse engineering of        |             |      |         |
|   | binaries? Are source code        |             |      |         |
|   | obfuscation techniques used? Are |             |      |         |
|   | legal agreements in place to     |             |      |         |
|   | protect against?                 |             |      |         |
+---+----------------------------------+-------------+------+---------+
| C |                                  |             |      |         |
| o |                                  |             |      |         |
| m |                                  |             |      |         |
| p |                                  |             |      |         |
| o |                                  |             |      |         |
| n |                                  |             |      |         |
| e |                                  |             |      |         |
| n |                                  |             |      |         |
| t |                                  |             |      |         |
| A |                                  |             |      |         |
| s |                                  |             |      |         |
| s |                                  |             |      |         |
| e |                                  |             |      |         |
| m |                                  |             |      |         |
| b |                                  |             |      |         |
| l |                                  |             |      |         |
| y |                                  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 3 | Does the software have any       |             | 2    |         |
| 9 | security critical dependencies   |             |      |         |
|   | or need additional controls from |             |      |         |
|   | other software (e.g., operating  |             |      |         |
|   | system, directory service,       |             |      |         |
|   | applications), firmware, or      |             |      |         |
|   | hardware? If yes, please         |             |      |         |
|   | describe.                        |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 4 | Is the software regularized to   |             | 1    |         |
| 0 | conform to coding or API         |             |      |         |
|   | standards in any way?            |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 4 | Is delivery of demonstrably      |             | 2    |         |
| 1 | secure software a contractual    |             |      |         |
|   | requirement for third-party      |             |      |         |
|   | developed software? If yes, what |             |      |         |
|   | criteria are used to             |             |      |         |
|   | operationally define "secure     |             |      |         |
|   | software"?                       |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 4 | Are additional risk management   |             | 2    |         |
| 2 | measures in place in the         |             |      |         |
|   | software's design to mitigate    |             |      |         |
|   | risks posed by use of            |             |      |         |
|   | third-party components?          |             |      |         |
+---+----------------------------------+-------------+------+---------+
| T |                                  |             |      |         |
| e |                                  |             |      |         |
| s |                                  |             |      |         |
| t |                                  |             |      |         |
| i |                                  |             |      |         |
| n |                                  |             |      |         |
| g |                                  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 4 | What types of functional tests   |             | 2    |         |
| 3 | are performed on the software    |             |      |         |
|   | during its development (e.g.,    |             |      |         |
|   | spot checking, component-level   |             |      |         |
|   | testing, security testing,       |             |      |         |
|   | integrated testing)?             |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 4 | Does your company's defect       |             | 3    |         |
| 4 | classification schemes include   |             |      |         |
|   | security categories? During      |             |      |         |
|   | testing what proportion of       |             |      |         |
|   | identified defects relate to     |             |      |         |
|   | security?                        |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 4 | What degree of code coverage     |             | 2    |         |
| 5 | does your testing provide?       |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 4 | Are misuse test cases included   |             | 2    |         |
| 6 | to exercise potential abuse      |             |      |         |
|   | scenarios of the software?       |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 4 | Are security-specific regression |             | 3    |         |
| 7 | tests performed during the       |             |      |         |
|   | development process? If yes, how |             |      |         |
|   | frequently are the tests         |             |      |         |
|   | performed?                       |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 4 | When does security testing occur |             | 1    |         |
| 8 | during the SDLC (e.g., unit      |             |      |         |
|   | level, subsystem, system,        |             |      |         |
|   | certification and                |             |      |         |
|   | accreditation)?                  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| I |                                  |             |      |         |
| n |                                  |             |      |         |
| s |                                  |             |      |         |
| t |                                  |             |      |         |
| a |                                  |             |      |         |
| l |                                  |             |      |         |
| l |                                  |             |      |         |
| a |                                  |             |      |         |
| t |                                  |             |      |         |
| i |                                  |             |      |         |
| o |                                  |             |      |         |
| n |                                  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 4 | If you are responsible for       |             | 4    |         |
| 9 | installing the software, is this |             |      |         |
|   | done by your organization or     |             |      |         |
|   | through third-party consultants? |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 5 | Is a validation test suite or    |             | 3    |         |
| 0 | diagnostic available to validate |             |      |         |
|   | that the application software is |             |      |         |
|   | operating correctly and in a     |             |      |         |
|   | secure configuration following   |             |      |         |
|   | installation?                    |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 5 | What training/documentation is   |             | 2    |         |
| 1 | available for software           |             |      |         |
|   | installation and maintenance?    |             |      |         |
+---+----------------------------------+-------------+------+---------+
| A |                                  |             |      |         |
| s |                                  |             |      |         |
| s |                                  |             |      |         |
| u |                                  |             |      |         |
| r |                                  |             |      |         |
| a |                                  |             |      |         |
| n |                                  |             |      |         |
| c |                                  |             |      |         |
| e |                                  |             |      |         |
| C |                                  |             |      |         |
| l |                                  |             |      |         |
| a |                                  |             |      |         |
| i |                                  |             |      |         |
| m |                                  |             |      |         |
| s |                                  |             |      |         |
| a |                                  |             |      |         |
| n |                                  |             |      |         |
| d |                                  |             |      |         |
| E |                                  |             |      |         |
| v |                                  |             |      |         |
| i |                                  |             |      |         |
| d |                                  |             |      |         |
| e |                                  |             |      |         |
| n |                                  |             |      |         |
| c |                                  |             |      |         |
| e |                                  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 5 | Does your company develop        |             | 2    |         |
| 2 | security measurement objectives  |             |      |         |
|   | for phases of the SDLC? Has your |             |      |         |
|   | company identified specific      |             |      |         |
|   | statistical and/or qualitative   |             |      |         |
|   | analytical techniques for        |             |      |         |
|   | measuring attainment of security |             |      |         |
|   | measures?                        |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 5 | Has the software been            |             | 2    |         |
| 3 | measured/assessed for its        |             |      |         |
|   | resistance to identified         |             |      |         |
|   | relevant attack patterns? Are    |             |      |         |
|   | Common Vulnerabilities &         |             |      |         |
|   | Exposures (CVE®) or Common       |             |      |         |
|   | Weakness Enumeration (CWEs)      |             |      |         |
|   | used? How have the findings been |             |      |         |
|   | mitigated?                       |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 5 | Are static or dynamic software   |             | 1    |         |
| 4 | security analysis tools used to  |             |      |         |
|   | identify the weaknesses that can |             |      |         |
|   | lead to exploitable              |             |      |         |
|   | vulnerabilities in the software? |             |      |         |
|   | If yes, which tools are used?    |             |      |         |
|   | What classes of weaknesses are   |             |      |         |
|   | covered? When in the SDLC are    |             |      |         |
|   | these scans performed? Are SwA   |             |      |         |
|   | experts involved in the analysis |             |      |         |
|   | of the scan results?             |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 5 | Does the software contain        |             | 3    |         |
| 5 | third-party developed            |             |      |         |
|   | components? If yes, are those    |             |      |         |
|   | components scanned by a static   |             |      |         |
|   | code analysis tool?              |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 5 | Has the software undergone any   |             | 1    |         |
| 6 | penetration testing? When? By    |             |      |         |
|   | whom? Are the test reports       |             |      |         |
|   | available under a nondisclosure  |             |      |         |
|   | agreement? How have the findings |             |      |         |
|   | been mitigated?                  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 5 | Are there current publicly-known |             | 2    |         |
| 7 | vulnerabilities in the software  |             |      |         |
|   | (e.g., an unrepaired CWE entry)? |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 5 | How is the assurance of software |             | 2    |         |
| 8 | produced by third-party          |             |      |         |
|   | developers assessed?             |             |      |         |
+---+----------------------------------+-------------+------+---------+
| S |                                  |             |      |         |
| u |                                  |             |      |         |
| p |                                  |             |      |         |
| p |                                  |             |      |         |
| o |                                  |             |      |         |
| r |                                  |             |      |         |
| t |                                  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 5 | Are multiple tiers of support    |             | 3    |         |
| 9 | contracts available? If yes,     |             |      |         |
|   | please describe the support      |             |      |         |
|   | plans available.                 |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 6 | Is there a Support Lifecycle     |             | 3    |         |
| 0 | Policy for the software in       |             |      |         |
|   | question? Does it outline and    |             |      |         |
|   | establish a consistent and       |             |      |         |
|   | predictable support timeline?    |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 6 | How will patches and/or Service  |             | 2    |         |
| 1 | Packs be distributed to the      |             |      |         |
|   | Acquirer?                        |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 6 | How are trouble tickets          |             | 3    |         |
| 2 | submitted? How are support       |             |      |         |
|   | issues, specifically those that  |             |      |         |
|   | security related, escalated?     |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 6 | Are help desk or support center  |             | 3    |         |
| 3 | personnel internal company       |             |      |         |
|   | resources or are these services  |             |      |         |
|   | outsourced to third parties?     |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 6 | If help desk or support center   |             | 3    |         |
| 4 | services are outsourced to third |             |      |         |
|   | parties, are they located in     |             |      |         |
|   | foreign countries?               |             |      |         |
+---+----------------------------------+-------------+------+---------+
| S |                                  |             |      |         |
| o |                                  |             |      |         |
| f |                                  |             |      |         |
| t |                                  |             |      |         |
| w |                                  |             |      |         |
| a |                                  |             |      |         |
| r |                                  |             |      |         |
| e |                                  |             |      |         |
| C |                                  |             |      |         |
| h |                                  |             |      |         |
| a |                                  |             |      |         |
| n |                                  |             |      |         |
| g |                                  |             |      |         |
| e |                                  |             |      |         |
| M |                                  |             |      |         |
| a |                                  |             |      |         |
| n |                                  |             |      |         |
| a |                                  |             |      |         |
| g |                                  |             |      |         |
| e |                                  |             |      |         |
| m |                                  |             |      |         |
| e |                                  |             |      |         |
| n |                                  |             |      |         |
| t |                                  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 6 | What are your policies and       |             | 1    |         |
| 5 | procedures for maintaining       |             |      |         |
|   | development documents, including |             |      |         |
|   | requirements, design and         |             |      |         |
|   | architecture documents, source   |             |      |         |
|   | code, binaries, and user         |             |      |         |
|   | documentation?                   |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 6 | Are your version control and     |             | 2    |         |
| 6 | configuration management         |             |      |         |
|   | policies and procedures the same |             |      |         |
|   | throughout your entire           |             |      |         |
|   | organization? How are they       |             |      |         |
|   | enforced? Are third-party        |             |      |         |
|   | developers contractually         |             |      |         |
|   | required to follow these         |             |      |         |
|   | policies and procedures?         |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 6 | Are configuration/change         |             | 1    |         |
| 7 | controls in place to prevent     |             |      |         |
|   | unauthorized modifications or    |             |      |         |
|   | additions to source code and     |             |      |         |
|   | related documentation? Do these  |             |      |         |
|   | controls detect and report       |             |      |         |
|   | unexpected                       |             |      |         |
|   | modifications/additions to       |             |      |         |
|   | source code? Do they aid in      |             |      |         |
|   | rolling back an affected         |             |      |         |
|   | artifact to a pre-modified       |             |      |         |
|   | version?                         |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 6 | Are there any undocumented       |             | 4    |         |
| 8 | features present not intended    |             |      |         |
|   | for use by end users, but        |             |      |         |
|   | available for use by the         |             |      |         |
|   | supplier for technical support   |             |      |         |
|   | and development?                 |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 6 | How are reports of defects,      |             | 2    |         |
| 9 | vulnerabilities, and security    |             |      |         |
|   | incidents involving the software |             |      |         |
|   | collected, tracked, and          |             |      |         |
|   | prioritized?                     |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 7 | What are your policies and       |             | 2    |         |
| 0 | practices for reviewing design   |             |      |         |
|   | and architecture security        |             |      |         |
|   | impacts in relation to deploying |             |      |         |
|   | patches?                         |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 7 | Does your organization have      |             | 3    |         |
| 1 | policies and procedures in place |             |      |         |
|   | to monitor and audit the         |             |      |         |
|   | transmission of its              |             |      |         |
|   | technology-related intellectual  |             |      |         |
|   | property to third parties, and   |             |      |         |
|   | to prevent unauthorized          |             |      |         |
|   | transmission of that             |             |      |         |
|   | intellectual property?           |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 7 | What policies and processes does |             | 2    |         |
| 2 | your organization use to verify  |             |      |         |
|   | that software components do not  |             |      |         |
|   | contain unintended, "dead," or   |             |      |         |
|   | malicious code? What tools are   |             |      |         |
|   | used?                            |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 7 | Is a process utilized by your    |             | 3    |         |
| 3 | company that can be used for     |             |      |         |
|   | documenting and analyzing the    |             |      |         |
|   | security aspects of fielded      |             |      |         |
|   | systems and for steering future  |             |      |         |
|   | improvements and modifications   |             |      |         |
|   | to those systems?                |             |      |         |
+---+----------------------------------+-------------+------+---------+
| T |                                  |             |      |         |
| i |                                  |             |      |         |
| m |                                  |             |      |         |
| e |                                  |             |      |         |
| l |                                  |             |      |         |
| i |                                  |             |      |         |
| n |                                  |             |      |         |
| e |                                  |             |      |         |
| s |                                  |             |      |         |
| s |                                  |             |      |         |
| o |                                  |             |      |         |
| f |                                  |             |      |         |
| V |                                  |             |      |         |
| u |                                  |             |      |         |
| l |                                  |             |      |         |
| n |                                  |             |      |         |
| e |                                  |             |      |         |
| r |                                  |             |      |         |
| a |                                  |             |      |         |
| b |                                  |             |      |         |
| i |                                  |             |      |         |
| l |                                  |             |      |         |
| i |                                  |             |      |         |
| t |                                  |             |      |         |
| y |                                  |             |      |         |
| M |                                  |             |      |         |
| i |                                  |             |      |         |
| t |                                  |             |      |         |
| i |                                  |             |      |         |
| g |                                  |             |      |         |
| a |                                  |             |      |         |
| t |                                  |             |      |         |
| i |                                  |             |      |         |
| o |                                  |             |      |         |
| n |                                  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 7 | Does your company have a         |             | 1    |         |
| 4 | vulnerability management and     |             |      |         |
|   | reporting policy? Is it          |             |      |         |
|   | available for review?            |             |      |         |
+---+----------------------------------+-------------+------+---------+
| I |                                  |             |      |         |
| n |                                  |             |      |         |
| d |                                  |             |      |         |
| i |                                  |             |      |         |
| v |                                  |             |      |         |
| i |                                  |             |      |         |
| d |                                  |             |      |         |
| u |                                  |             |      |         |
| a |                                  |             |      |         |
| l |                                  |             |      |         |
| M |                                  |             |      |         |
| a |                                  |             |      |         |
| l |                                  |             |      |         |
| i |                                  |             |      |         |
| c |                                  |             |      |         |
| i |                                  |             |      |         |
| o |                                  |             |      |         |
| u |                                  |             |      |         |
| s |                                  |             |      |         |
| B |                                  |             |      |         |
| e |                                  |             |      |         |
| h |                                  |             |      |         |
| a |                                  |             |      |         |
| v |                                  |             |      |         |
| i |                                  |             |      |         |
| o |                                  |             |      |         |
| r |                                  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 7 | Does your company perform        |             | 2    |         |
| 5 | background checks on members of  |             |      |         |
|   | the software development team?   |             |      |         |
|   | If so, are there any additional  |             |      |         |
|   | "vetting" checks done on people  |             |      |         |
|   | who work on critical application |             |      |         |
|   | components, such as security?    |             |      |         |
|   | Explain.                         |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 7 | Does your company have formally  |             | 2    |         |
| 6 | defined security policies        |             |      |         |
|   | associated with clearly defined  |             |      |         |
|   | roles and responsibilities for   |             |      |         |
|   | personnel working within the     |             |      |         |
|   | software development life cycle, |             |      |         |
|   | along with management oversight  |             |      |         |
|   | and enforcement? Explain.        |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 7 | What training is available to    |             | 3    |         |
| 7 | your development staff to help   |             |      |         |
|   | them identify malicious          |             |      |         |
|   | behavior? Are there formal       |             |      |         |
|   | policies for reporting malicious |             |      |         |
|   | behavior?                        |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 7 | Has civil legal action ever been |             | 3    |         |
| 8 | filed against your company for   |             |      |         |
|   | delivering or failing to correct |             |      |         |
|   | defective software? Explain.     |             |      |         |
+---+----------------------------------+-------------+------+---------+
| O |                                  |             |      |         |
| 9 |                                  |             |      |         |
| g |                                  |             |      |         |
| a |                                  |             |      |         |
| n |                                  |             |      |         |
| i |                                  |             |      |         |
| z |                                  |             |      |         |
| a |                                  |             |      |         |
| t |                                  |             |      |         |
| i |                                  |             |      |         |
| o |                                  |             |      |         |
| n |                                  |             |      |         |
| a |                                  |             |      |         |
| l |                                  |             |      |         |
| H |                                  |             |      |         |
| i |                                  |             |      |         |
| s |                                  |             |      |         |
| t |                                  |             |      |         |
| o |                                  |             |      |         |
| r |                                  |             |      |         |
| y |                                  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 7 | Please summarize your company's  |             | 3    |         |
| 9 | history of ownership,            |             |      |         |
|   | acquisitions, and mergers (both  |             |      |         |
|   | those performed by your company  |             |      |         |
|   | and those to which your company  |             |      |         |
|   | was subjected).                  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 8 | Please provide a list of the     |             | 3    |         |
| 0 | names and dates of service of    |             |      |         |
|   | the following executive          |             |      |         |
|   | officers:                        |             |      |         |
|   |                                  |             |      |         |
|   | -   Chairman of the Board (COB)  |             |      |         |
|   |                                  |             |      |         |
|   | -   Chief Executive Officer      |             |      |         |
|   |     (CEO)                        |             |      |         |
|   |                                  |             |      |         |
|   | -   President (if different from |             |      |         |
|   |     CEO)                         |             |      |         |
|   |                                  |             |      |         |
|   | -   Vice President(s)            |             |      |         |
|   |                                  |             |      |         |
|   | -   Chief Financial Officer      |             |      |         |
|   |     (CFO)                        |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 8 | How many employees does your     |             | 4    |         |
| 1 | company have:                    |             |      |         |
|   |                                  |             |      |         |
|   | -   In the U.S.?                 |             |      |         |
|   |                                  |             |      |         |
|   | -   Worldwide?                   |             |      |         |
+---+----------------------------------+-------------+------+---------+
| F |                                  |             |      |         |
| o |                                  |             |      |         |
| r |                                  |             |      |         |
| e |                                  |             |      |         |
| i |                                  |             |      |         |
| g |                                  |             |      |         |
| n |                                  |             |      |         |
| I |                                  |             |      |         |
| n |                                  |             |      |         |
| t |                                  |             |      |         |
| e |                                  |             |      |         |
| r |                                  |             |      |         |
| e |                                  |             |      |         |
| s |                                  |             |      |         |
| t |                                  |             |      |         |
| s |                                  |             |      |         |
| a |                                  |             |      |         |
| n |                                  |             |      |         |
| d |                                  |             |      |         |
| I |                                  |             |      |         |
| n |                                  |             |      |         |
| f |                                  |             |      |         |
| l |                                  |             |      |         |
| u |                                  |             |      |         |
| e |                                  |             |      |         |
| n |                                  |             |      |         |
| c |                                  |             |      |         |
| e |                                  |             |      |         |
| s |                                  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 8 | Is the controlling share (51+%)  |             | 3    |         |
| 2 | of your company owned by a       |             |      |         |
|   | non-U.S. entity? If so, please   |             |      |         |
|   | complete Standard Form 328,      |             |      |         |
|   | Certificate Pertaining to        |             |      |         |
|   | Foreign Interests.               |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 8 | Is your company an entity of a   |             | 3    |         |
| 3 | larger "parent" company? If yes" |             |      |         |
|   | does that "parent" company       |             |      |         |
|   | include any subsidiaries or      |             |      |         |
|   | other sub-entities that are 51+% |             |      |         |
|   | foreign owned? If so, please     |             |      |         |
|   | identify those                   |             |      |         |
|   | subsidiaries/sub-entities.       |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 8 | Please provide company names of  |             | 3    |         |
| 4 | all third-party entities with    |             |      |         |
|   | whom your firm contracts         |             |      |         |
|   | software development,            |             |      |         |
|   | maintenance, or support services |             |      |         |
|   | related to this procurement.     |             |      |         |
+---+----------------------------------+-------------+------+---------+
| F |                                  |             |      |         |
| i |                                  |             |      |         |
| n |                                  |             |      |         |
| a |                                  |             |      |         |
| n |                                  |             |      |         |
| c |                                  |             |      |         |
| i |                                  |             |      |         |
| a |                                  |             |      |         |
| l |                                  |             |      |         |
| H |                                  |             |      |         |
| i |                                  |             |      |         |
| s |                                  |             |      |         |
| t |                                  |             |      |         |
| o |                                  |             |      |         |
| r |                                  |             |      |         |
| y |                                  |             |      |         |
| a |                                  |             |      |         |
| n |                                  |             |      |         |
| d |                                  |             |      |         |
| S |                                  |             |      |         |
| t |                                  |             |      |         |
| a |                                  |             |      |         |
| t |                                  |             |      |         |
| u |                                  |             |      |         |
| s |                                  |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 8 | Has your company ever filed for  |             | 3    |         |
| 5 | Recompany under U.S. Code        |             |      |         |
|   | Chapter 11? If so, please        |             |      |         |
|   | provide dates for each incident  |             |      |         |
|   | and describe the outcome.        |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 8 | What are your company's policies |             | 3    |         |
| 6 | and procedures for periodically  |             |      |         |
|   | reviewing the financial health   |             |      |         |
|   | of the third-party entities with |             |      |         |
|   | which it contracts for software  |             |      |         |
|   | development, maintenance, or     |             |      |         |
|   | support services?                |             |      |         |
+---+----------------------------------+-------------+------+---------+
| 8 | What are your company's policies |             | 2    |         |
| 7 | and procedures for dealing with  |             |      |         |
|   | the contractual obligations of   |             |      |         |
|   | third party developers that go   |             |      |         |
|   | out of business?                 |             |      |         |
+---+----------------------------------+-------------+------+---------+