Lexim011/Compliance huggingface dataset:
CCI-000700 (policy): Provide an alternate configuration management process using organizational personnel in the absence of a dedicated developer configuration management team.
References: NIST: NIST SP 800-53 (v3): SA-10 (2) NIST: NIST SP 800-53 Revision 4 (v4): SA-10 (2) NIST: NIST SP 800-53 Revision 5 (v5): SA-10 (2) NIST: NIST SP 800-53A (v1): SA-10 (2).1
CCI-003165 (policy): Require the developer of the system, system component, or system service to enable integrity verification of hardware components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-10 (3) NIST: NIST SP 800-53 Revision 5 (v5): SA-10 (3)
CCI-003166 (policy): Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of security-relevant hardware descriptions with previous versions.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-10 (4) NIST: NIST SP 800-53 Revision 5 (v5): SA-10 (4)
CCI-003167 (policy): Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of source code with previous versions.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-10 (4) NIST: NIST SP 800-53 Revision 5 (v5): SA-10 (4)
CCI-003168 (policy): Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of object code with previous versions.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-10 (4) NIST: NIST SP 800-53 Revision 5 (v5): SA-10 (4)
CCI-003169 (policy): Require the developer of the system, system component, or system service to maintain the integrity of the mapping between the master build data describing the current version of security-relevant hardware, software, and firmware and the on-site master copy of the data for the current version.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-10 (5) NIST: NIST SP 800-53 Revision 5 (v5): SA-10 (5)
CCI-003170 (policy): Require the developer of the system, system component, or system service to execute procedures for ensuring that security-relevant hardware, software, and firmware updates distributed to the organization are exactly as specified by the master copies.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-10 (6) NIST: NIST SP 800-53 Revision 5 (v5): SA-10 (6)
CCI-004795 (policy): Require organization-defined security and privacy representatives to be included in the organization-defined configuration change management and control process.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-10 (7)
CCI-004796 (policy): Defines the security and privacy representatives to be included the organization-defined configuration change management and control process.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-10 (7)
CCI-004797 (policy): Defines the configuration change management and control process required for the organization-defined security and privacy representatives.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-10 (7)
CCI-003171 (policy): Require the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to develop a plan for ongoing security control assessment.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 a NIST: NIST SP 800-53 Revision 5 (v5): SA-11 a
CCI-003172 (policy): Require the developer of the system, system component, or system service to implement a plan for ongoing security control assessment.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 a NIST: NIST SP 800-53 Revision 5 (v5): SA-11 a
CCI-004798 (policy): Require the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to develop a plan for ongoing privacy control assessment.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-11 a
CCI-004799 (policy): Require the developer of the system, system component, or system service to implement a plan for ongoing privacy control assessment.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-11 a
CCI-003173 (policy): Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to perform unit, integration, system, and/or regression testing/evaluation on an organization-defined frequency, at an organization-defined depth and coverage.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 b NIST: NIST SP 800-53 Revision 5 (v5): SA-11 b
CCI-003174 (policy): Defines the depth and coverage at which to perform unit, integration, system, and/or regression testing/evaluation on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 b NIST: NIST SP 800-53 Revision 5 (v5): SA-11 b
CCI-004800 (policy): Defines the frequency that the unit, integration, system, and/or regression testing/evaluation is performed at an organization-defined depth and coverage.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-11 b
CCI-003175 (policy): Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to produce evidence of the execution of the assessment plan.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 c NIST: NIST SP 800-53 Revision 5 (v5): SA-11 c
CCI-003176 (policy): Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to produce the results of the testing and evaluation.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 c NIST: NIST SP 800-53 Revision 5 (v5): SA-11 c
CCI-003177 (policy): Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to implement a verifiable flaw remediation process.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 d NIST: NIST SP 800-53 Revision 5 (v5): SA-11 d
CCI-003178 (policy): Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to correct flaws identified during testing/evaluation.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 e NIST: NIST SP 800-53 Revision 5 (v5): SA-11 e
CCI-003179 (policy): Require the developer of the system, system component, or system service to employ static code analysis tools to identify common flaws.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (1) NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (1)
CCI-003180 (policy): Require the developer of the system, system component, or system service to document the results of static code analysis.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (1) NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (1)
CCI-003181 (policy): Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analyses during development.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (2) NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (2)
CCI-003182 (policy): Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analysis during subsequent testing and evaluation of the system, component, or service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (2) NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (2)
CCI-004801 (policy): Use the following contextual information.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (2) (a)
CCI-004802 (policy): Defines the information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (2) (a)
CCI-004803 (policy): Employ the following tools and methods.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (2) (b)
CCI-004804 (policy): Defines the tools and methods to be employed.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (2) (b)
CCI-004805 (policy): Conduct the modeling and analyses as the following level of rigor.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (2) (c)
CCI-004806 (policy): Defines the breadth and depth of modeling and analyses the level of rigor will be conducted.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (2) (c)
CCI-004807 (policy): Produces evidence that meets the following acceptance criteria.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (2) (d)
CCI-004808 (policy): Defines the acceptance criteria that meets the requirement for producing evidence.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (2) (d)
CCI-003183 (policy): Require an independent agent satisfying organization-defined independence criteria to verify the correct implementation of the developer security assessment plan.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (3) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (3) (a)
CCI-003184 (policy): Require an independent agent satisfying organization-defined independence criteria to verify the evidence produced during security testing and evaluation.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (3) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (3) (a)
CCI-003185 (policy): Defines the independence criteria the independent agent must satisfy prior to verifying the correct implementation of the developer security assessment plan and the evidence produced during security testing and evaluation.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (3) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (3) (a)
CCI-004809 (policy): Require an independent agent satisfying organization-defined independence criteria to verify the correct implementation of the developer privacy assessment plan.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (3) (a)
CCI-004810 (policy): Require an independent agent satisfying organization-defined independence criteria to verify the evidence produced during privacy testing and evaluation.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (3) (a)
CCI-004811 (policy): Defines the independence criteria the independent agent must satisfy prior to verifying the correct implementation of the developer privacy assessment plan and the evidence produced during privacy testing and evaluation.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (3) (a)
CCI-003186 (policy): Verify that the independent agent either is provided with sufficient information to complete the verification process or has been granted the authority to obtain such information.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (3) (b) NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (3) (b)
CCI-003187 (policy): Require the developer of the system, system component, or system service to perform a manual code review of organization-defined specific code using organization-defined processes, procedures, and/or techniques.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (4) NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (4)
CCI-003188 (policy): Defines the specific code for which the developer of the system, system component, or system service is required to perform a manual code review using organization-defined process, procedures, and/or techniques.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (4) NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (4)
CCI-003189 (policy): Defines the processes, procedures, and/or techniques to be used by the developer of the system, system component, or system service to perform a manual code review of organization-defined specific code.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (4) NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (4)
CCI-003191 (policy): Defines the breadth and depth at which the developer of the system, system component, or system service is required to perform penetration testing.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (5) NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (5) (a)
CCI-004812 (policy): Require the developer of the system, system component, or system service to perform penetration testing at an organization-defined breadth and depth of testing.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (5) (a)
CCI-003192 (policy): Defines the constraints on penetration testing performed by the developer of the system, system component, or system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (5) NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (5) (b)
CCI-004813 (policy): Require the developer of the system, system component, or system service to perform penetration testing under organization-defined constraints.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (5) (b)
CCI-003193 (policy): Require the developer of the system, system component, or system service to perform attack surface reviews.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (6) NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (6)
CCI-003194 (policy): Require the developer of the system, system component, or system service to verify that the scope of testing and evaluation provides complete coverage of required controls at an organization-defined depth of testing and evaluation.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (7) NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (7)
CCI-003195 (policy): Defines the depth of testing and evaluation to which the developer of the system, system component, or system service is required to verify that the scope of security testing and evaluation provides complete coverage of the required controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (7) NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (7)
CCI-003196 (policy): Require the developer of the system, system component, or system service to employ dynamic code analysis tools to identify common flaws.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (8) NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (8)
CCI-003197 (policy): Require the developer of the system, system component, or system service to document the results of the dynamic code analysis.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (8) NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (8)
CCI-004814 (policy): Require the developer of the system, system component, or system service to employ interactive application security testing tools to identify flaws.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (9)
CCI-004815 (policy): Require the developer of the system, system component, or system service to employ interactive application security testing tools to document the results.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (9)
CCI-003233 (policy): Require the developer of the system, system component, or system service to follow a documented development process.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 NIST: NIST SP 800-53 Revision 5 (v5): SA-15 a
CCI-003234 (policy): Require the developer of the system, system component, or system service to follow a documented development process that explicitly addresses security requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 a 1 NIST: NIST SP 800-53 Revision 5 (v5): SA-15 a 1
CCI-003235 (policy): Require the developer of the system, system component, or system service to follow a documented development process that identifies the standards used in the development process.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 a 2 NIST: NIST SP 800-53 Revision 5 (v5): SA-15 a 2
CCI-003236 (policy): Require the developer of the system, system component, or system service to follow a documented development process that identifies the tools used in the development process.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 a 2 NIST: NIST SP 800-53 Revision 5 (v5): SA-15 a 2
CCI-003237 (policy): Require the developer of the system, system component, or system service to follow a documented development process that documents the specific tool options and tool configurations used in the development process.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 a 3 NIST: NIST SP 800-53 Revision 5 (v5): SA-15 a 3
CCI-003238 (policy): Require the developer of the system, system component, or system service to follow a documented development process that documents changes to the process and/or tools used in development.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 a 4 NIST: NIST SP 800-53 Revision 5 (v5): SA-15 a 4
CCI-003239 (policy): Require the developer of the system, system component, or system service to follow a documented development process that manages changes to the process and/or tools used in development.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 a 4 NIST: NIST SP 800-53 Revision 5 (v5): SA-15 a 4
CCI-003240 (policy): Require the developer of the system, system component, or system service to follow a documented development process that ensures the integrity of changes to the process and/or tools used in development.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 a 4 NIST: NIST SP 800-53 Revision 5 (v5): SA-15 a 4
CCI-004816 (policy): Require the developer of the system, system component, or system service to follow a documented development process that explicitly addresses privacy requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-15 a 1
CCI-003241 (policy): Review the development process in accordance with organization-defined frequency to determine if the development process selected and employed can satisfy organization-defined security requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 b NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b
CCI-003242 (policy): Review the development standards in accordance with organization-defined frequency to determine if the development standards selected and employed can satisfy organization-defined security requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 b NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b
CCI-003243 (policy): Review the development tools in accordance with organization-defined frequency to determine if the development tools selected and employed can satisfy organization-defined security requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 b NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b
CCI-003244 (policy): Review the development tool options/configurations in accordance with organization-defined frequency to determine if the development tool options and tool configurations selected and employed can satisfy organization-defined security requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 b NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b
CCI-003245 (policy): Defines the frequency on which to review the development process, standards, tools, and tool options/configurations to determine if the process, standards, tools, and tool options and tool configurations selected and employed can satisfy organization-defined security requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 b NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b
CCI-003246 (policy): Defines the security requirements that must be satisfied by conducting a review of the development process, standards, tools, and tool options and tool configurations.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 b NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b
CCI-004817 (policy): Review the development process in accordance with organization-defined frequency to determine if the development process selected and employed can satisfy organization-defined privacy requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b
CCI-004818 (policy): Review the development standards in accordance with organization-defined frequency to determine if the development standards selected and employed can satisfy organization-defined privacy requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b
CCI-004819 (policy): Review the development tools in accordance with organization-defined frequency to determine if the development tools selected and employed can satisfy organization-defined privacy requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b
CCI-004820 (policy): Review the development tool options/configurations in accordance with organization-defined frequency to determine if the development tool options and tool configurations selected and employed can satisfy organization-defined privacy requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b
CCI-004821 (policy): Defines the frequency on which to review the development process, standards, tools, and tool options/configurations to determine if the process, standards, tools, and tool options and tool configurations selected and employed can satisfy organization-defined privacy requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b
CCI-004822 (policy): Defines the privacy requirements that must be satisfied by conducting a review of the development process, standards, tools, and tool options and tool configurations.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b
CCI-003247 (policy): Require the developer of the system, system component, or system service to define quality metrics at the beginning of the development process.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (1) (a)
CCI-003248 (policy): Require the developer of the system, system component, or system service to provide evidence of meeting the quality metrics in accordance with organization-defined frequency, organization-defined program review milestones, and/or upon delivery.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (1) (b) NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (1) (b)
CCI-003249 (policy): Defines the frequency on which the developer of the information system, system component, or information system service is required to provide evidence of meeting the quality metrics.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (1) (b) NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (1) (b)
CCI-003250 (policy): Defines the program review milestones at which the developer of the information system, system component, or information system service is required to provide evidence of meeting the quality metrics.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (1) (b) NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (1) (b)
CCI-003251 (policy): Require the developer of the system, system component, or system service to select a security tracking tool for use during the development process.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (2) NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (2)
CCI-003252 (policy): Require the developer of the system, system component, or system service to employ a security tracking tool for use during the development process.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (2) NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (2)
CCI-004823 (policy): Require the developer of the system, system component, or system service to select a privacy tracking tool for use during the development process.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (2)
CCI-004824 (policy): Require the developer of the system, system component, or system service to employ a privacy tracking tool for use during the development process.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (2)
CCI-003255 (policy): Defines decision points in the system development life cycle at which the developer of the system, system component, or system service is required to perform a criticality analysis.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (3) NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (3) (a)
CCI-004825 (policy): Require the developer of the system, system component, or system service to perform a criticality analysis at the organization-defined decision points in the system development life cycle.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (3) (a)
CCI-003254 (policy): Defines the breadth/depth of criticality analysis at which the developer of the system, system component, or system service is required to perform a criticality analysis.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (3) NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (3) (b)
CCI-004826 (policy): Require the developer of the system, system component, or system service to perform a criticality analysis at an organization-defined breadth/depth of criticality analysis.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (3) (b)
CCI-003272 (policy): Require the developer of the system, system component, or system service to reduce attack surfaces to organization-defined thresholds.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (5) NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (5)
CCI-003273 (policy): Defines the thresholds to which the developer of the system, system component, or system service is required to reduce attack surfaces.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (5) NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (5)
CCI-003274 (policy): Require the developer of the system, system component, or system service to implement an explicit process to continuously improve the development process.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (6) NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (6)
CCI-003275 (policy): Require the developer of the system, system component, or system services, on an organization-defined frequency, to perform an automated vulnerability analysis using organization-defined tools.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (7) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (7) (a)
CCI-003276 (policy): Defines the tools the developer of the system, system component, or system services uses to perform an automated vulnerability analysis.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (7) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (7) (a)
CCI-004827 (policy): Defines the frequency for performing an automated vulnerability analysis using organization-defined tools.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (7) (a)
CCI-003277 (policy): Require the developer of the system, system component, or system services, on an organization-defined frequency, to determine the exploitation potential for discovered vulnerabilities.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (7) (b) NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (7) (b)
CCI-004828 (policy): Defines the frequency for determining the exploitation potential for discovered vulnerabilities.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (7) (b)
CCI-003278 (policy): Require the developer of the system, system component, or system services, on an organization-defined frequency, to determine potential risk mitigations for delivered vulnerabilities.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (7) (c) NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (7) (c)
CCI-004829 (policy): Defines the frequency for determining potential risk mitigations for delivered vulnerabilities.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (7) (c)
CCI-003279 (policy): Require the developer of the system, system component, or system services, on an organization-defined frequency, to deliver the outputs of the tools and results of the vulnerability analysis to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (7) (d) NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (7) (d)
CCI-003280 (policy): Defines the personnel or roles to whom the outputs of the tools and results of the vulnerability analysis are delivered.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (7) (d) NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (7) (d)
CCI-004830 (policy): Defines the frequency for delivering the outputs of the tools and results of the vulnerability analysis to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (7) (d)
CCI-003281 (policy): Require the developer of the system, system component, or system service to use threat modeling from similar systems, components, or services to inform the current development process.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (8) NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (8)
CCI-003282 (policy): Require the developer of the system, system component, or system service to use vulnerability analysis from similar systems, components, or services to inform the current development process.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (8) NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (8)
CCI-003289 (policy): Require the developer of the system, system component, or system service to provide an incident response plan.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (10) NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (10)
CCI-004831 (policy): Require the developer of the system, system component, or system service to implement an incident response plan.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (10)
CCI-004832 (policy): Require the developer of the system, system component, or system service to test an incident response plan.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (10)
CCI-003290 (policy): Require the developer of the system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security review.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (11) NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (11)
CCI-004833 (policy): Require the developer of the system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final privacy review.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (11)
CCI-004834 (policy): Require the developer of the system or system component to minimize the use of personally identifiable information in development and test environments.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (12)
CCI-003291 (policy): Require the developer of the system, system component, or system service to provide organization-defined training on the correct use and operation of the implemented security functions, controls, and/or mechanisms.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-16 NIST: NIST SP 800-53 Revision 5 (v5): SA-16
CCI-003292 (policy): Defines the training the developer of the system, system component, or information system service is required to provide on the correct use and operation of the implemented security functions, controls, and/or mechanisms.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-16 NIST: NIST SP 800-53 Revision 5 (v5): SA-16
CCI-004835 (policy): Require the developer of the system, system component, or system service to provide organization-defined training on the correct use and operation of the implemented privacy functions, controls, and/or mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-16
CCI-004836 (policy): Defines the training the developer of the system, system component, or information system service is required to provide on the correct use and operation of the implemented privacy functions, controls, and/or mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-16
CCI-003293 (policy): Require the developer of the system, system component, or system service to produce a design specification and security architecture.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 NIST: NIST SP 800-53 Revision 5 (v5): SA-17
CCI-004837 (policy): Require the developer of the system, system component, or system service to produce a privacy architecture.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-17
CCI-003294 (policy): Require the developer of the system, system component, or system service to produce a design specification and security architecture that is consistent with and supportive of the organization's security architecture which is established within and is an integrated part of the organization's enterprise architecture.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 a NIST: NIST SP 800-53 Revision 5 (v5): SA-17 a
CCI-004838 (policy): Require the developer of the system, system component, or system service to produce a privacy architecture that is consistent with and supportive of the organization's privacy architecture which is established within and is an integrated part of the organization's enterprise architecture.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-17 a
CCI-003295 (policy): Require the developer of the system, system component, or system service to produce a design specification and security architecture that accurately and completely describes the required security functionality.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 b NIST: NIST SP 800-53 Revision 5 (v5): SA-17 b
CCI-003296 (policy): Require the developer of the system, system component, or system service to produce a design specification and security architecture that accurately and completely describes the allocation of security controls among physical and logical components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 b NIST: NIST SP 800-53 Revision 5 (v5): SA-17 b
CCI-004839 (policy): Require the developer of the system, system component, or system service to produce a privacy architecture that accurately and completely describes the required privacy functionality.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-17 b
CCI-004840 (policy): Require the developer of the system, system component, or system service to produce a privacy architecture that accurately and completely describes the allocation of privacy controls among physical and logical components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-17 b
CCI-003297 (policy): Require the developer of the system, system component, or system service to produce a design specification and security architecture that expresses how individual security functions, mechanisms, and services work together to provide required security capabilities and a unified approach to protection.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 c NIST: NIST SP 800-53 Revision 5 (v5): SA-17 c
CCI-004841 (policy): Require the developer of the system, system component, or system service to produce a privacy architecture that expresses how individual privacy functions, mechanisms, and services work together to provide required privacy capabilities and a unified approach to protection.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-17 c
CCI-003298 (policy): Require the developer of the system, system component, or system to produce, as an integral part of the development process, a formal policy model describing the organization-defined elements of organizational security policy to be enforced.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (1) (a)
CCI-003299 (policy): Defines the elements of organizational security policy to be described in the formal policy model for enforcement on the system, system component, or system service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (1) (a)
CCI-004842 (policy): Require the developer of the system, system component, or system to produce, as an integral part of the development process, a formal policy model describing the organization-defined elements of organizational privacy policy to be enforced.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (1) (a)
CCI-004843 (policy): Defines the elements of organizational privacy policy to be described in the formal policy model for enforcement on the system, system component, or system service.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (1) (a)
CCI-003300 (policy): Require the developer of the system, system component, or system service to prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security policy when implemented.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (1) (b) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (1) (b)
CCI-004844 (policy): Require the developer of the system, system component, or system service to prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational privacy policy when implemented.
References: NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (1) (b)
CCI-003301 (policy): Require the developer of the system, system component, or system service to define security-relevant hardware.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (2) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (2) (a)
CCI-003303 (policy): Require the developer of the system, system component, or system service to define security-relevant software.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (2) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (2) (a)
CCI-003304 (policy): Require the developer of the system, system component, or system service to define security-relevant firmware.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (2) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (2) (a)
CCI-003305 (policy): Require the developer of the system, system component, or system service to provide a rationale that the definition for security-relevant hardware is complete.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (2) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (2) (b)
CCI-003306 (policy): Require the developer of the system, system component, or system service to provide a rationale that the definition for security-relevant software is complete.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (2) (b) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (2) (b)
CCI-003307 (policy): Require the developer of the system, system component, or system service to provide a rationale that the definition for security-relevant firmware is complete.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (2) (b) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (2) (b)
CCI-003308 (policy): Require the developer of the system, system component, or system service to produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant hardware in terms of exceptions, error messages, and effects.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (a)
CCI-003309 (policy): Require the developer of the system, system component, or system service to produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant software in terms of exceptions, error messages, and effects.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (a)
CCI-003310 (policy): Require the developer of the system, system component, or system service to produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant firmware in terms of exceptions, error messages, and effects.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (a)
CCI-003311 (policy): Require the developer of the system, system component, or system service to show via proof to the extent feasible with additional informal demonstration as necessary, that the formal top-level specification is consistent with the formal policy model.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (b) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (b)
CCI-003312 (policy): Require the developer of the system, system component, or system service to show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant hardware.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (c) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (c)
CCI-003313 (policy): Require the developer of the system, system component, or system service to show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant software.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (c) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (c)
CCI-003314 (policy): Require the developer of the system, system component, or system service to show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant firmware.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (c) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (c)
CCI-003315 (policy): Require the developer of the system, system component, or system service to show that the formal top-level specification is an accurate description of the implemented security-relevant hardware.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (d) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (d)
CCI-003316 (policy): Require the developer of the system, system component, or system service to show that the formal top-level specification is an accurate description of the implemented security-relevant software.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (d) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (d)
CCI-003317 (policy): Require the developer of the system, system component, or system service to show that the formal top-level specification is an accurate description of the implemented security-relevant firmware.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (d) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (d)
CCI-003318 (policy): Require the developer of the system, system component, or system service to describe the security-relevant hardware mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant hardware.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (e) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (e)
CCI-003319 (policy): Require the developer of the system, system component, or system service to describe the security-relevant software mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant software.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (e) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (e)
CCI-003320 (policy): Require the developer of the system, system component, or system service to describe the security-relevant firmware mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant firmware.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (e) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (e)
CCI-003321 (policy): Require the developer of the system, system component, or system service to produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant hardware in terms of exceptions, error messages, and effects.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (a)
CCI-003322 (policy): Require the developer of the system, system component, or system service to produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant software in terms of exceptions, error messages, and effects.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (a)
CCI-003323 (policy): Require the developer of the system, system component, or system service to produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant firmware in terms of exceptions, error messages, and effects.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (a)
CCI-003324 (policy): Require the developer of the system, system component, or system service to show via informal demonstration or convincing argument with formal methods as feasible that the descriptive top-level specification is consistent with the formal policy model.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (b) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (b)
CCI-003325 (policy): Require the developer of the system, system component, or system service to show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant hardware.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (c) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (c)
CCI-003326 (policy): Require the developer of the system, system component, or system service to show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant software.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (c) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (c)
CCI-003327 (policy): Require the developer of the system, system component, or system service to show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant firmware.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (c) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (c)
CCI-003328 (policy): Require the developer of the system, system component, or system service to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant hardware.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (d) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (d)
CCI-003329 (policy): Require the developer of the system, system component, or system service to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant software.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (d) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (d)
CCI-003330 (policy): Require the developer of the system, system component, or system service to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant firmware.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (d) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (d)
CCI-003331 (policy): Require the developer of the system, system component, or system service to describe the security-relevant hardware mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant hardware.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (e) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (e)
CCI-003332 (policy): Require the developer of the system, system component, or system service to describe the security-relevant software mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant software.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (e) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (e)
CCI-003333 (policy): Require the developer of the system, system component, or system service to describe the security-relevant firmware mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant firmware.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (e) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (e)
CCI-003334 (policy): Require the developer of the system, system component, or system service to design and structure the security-relevant hardware to use a complete, conceptually simple protection mechanism with precisely defined semantics.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (5) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (5) (a)
CCI-003335 (policy): Require the developer of the system, system component, or system service to design and structure the security-relevant software to use a complete, conceptually simple protection mechanism with precisely defined semantics.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (5) (a) NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (5) (a)