ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-10 > SA-10(7) > Assessment Methods

SA-10(7) Security and Privacy Representatives - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

configuration management policy

configuration management plan

solicitation documentation requiring representatives for security and privacy

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system developer configuration management plan

change control records

configuration management records

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel with configuration management responsibilities

system developers
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-10 > SA-10(7) > Assessment Objective

SA-10(7) Security and Privacy Representatives - Assessment Objective
Determine if the following are satisfied:

SA-10(07)[01] [Assignment: organization-defined security representatives] are required to be included in the [Assignment: organization-defined configuration change management and control processes];
SA-10(07)[02] [Assignment: organization-defined privacy representatives] are required to be included in the [Assignment: organization-defined configuration change management and control processes].
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-11 > Assessment Methods

SA-11 Developer Testing and Evaluation - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

procedures addressing system developer security and privacy testing

procedures addressing flaw remediation

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

security and privacy architecture

system design documentation

system developer security and privacy assessment plans

results of developer security and privacy assessments for the system, system component, or system service

security and privacy flaw and remediation tracking records

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel with developer security and privacy testing responsibilities

system developers

Test: Organizational processes for monitoring developer security testing and evaluation

mechanisms supporting and/or implementing the monitoring of developer security and privacy testing and evaluation
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-11 > Assessment Objective

SA-11 Developer Testing and Evaluation - Assessment Objective
Determine if the following are satisfied:

SA-11a.[01] the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop a plan for ongoing security assessments;
SA-11a.[02] the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing security assessments;
SA-11a.[03] the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop a plan for privacy assessments;
SA-11a.[04] the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing privacy assessments;
SA-11b. the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to perform [Selection; one or more: unit; integration; system; regression] testing/evaluation [Assignment: organization-defined frequency to conduct] at [Assignment: organization-defined depth and coverage];
SA-11c.[01] the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to produce evidence of the execution of the assessment plan;
SA-11c.[02] the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to produce the results of the testing and evaluation;
SA-11d. the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a verifiable flaw remediation process;
SA-11e. the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to correct flaws identified during testing and evaluation.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-11 > SA-11(1) > Assessment Methods

SA-11(1) Static Code Analysis - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

procedures addressing system developer security testing

procedures addressing flaw remediation

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

security and privacy architecture

system design documentation

system developer security and privacy assessment plans

results of system developer security and privacy assessments

security flaw and remediation tracking records

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with developer security and privacy testing responsibilities

organizational personnel with configuration management responsibilities

system developers

Test: Organizational processes for monitoring developer security testing and evaluation

mechanisms supporting and/or implementing the monitoring of developer security testing and evaluation

static code analysis tools
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-11 > SA-11(1) > Assessment Objective

SA-11(1) Static Code Analysis - Assessment Objective
Determine if the following are satisfied:

SA-11(01)[01] the developer of the system, system component, or system service is required to employ static code analysis tools to identify common flaws;
SA-11(01)[02] the developer of the system, system component, or system service is required to employ static code analysis tools to document the results of the analysis.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-11 > SA-11(2) > Assessment Methods

SA-11(2) Threat Modeling and Vulnerability Analyses - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing system developer security testing

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system developer security test plans

records of developer security testing results for the system, system component, or system service

vulnerability scanning results

system risk assessment reports

threat and vulnerability analysis reports

system security plan

supply chain risk management plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with developer security testing responsibilities

system developers

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for monitoring developer security testing and evaluation

mechanisms supporting and/or implementing the monitoring of developer security testing and evaluation
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-11 > SA-11(3) > Assessment Methods

SA-11(3) Independent Verification of Assessment Plans and Evidence - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

procedures addressing system developer security testing

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

independent verification and validation reports

security and privacy assessment plans

results of security and privacy assessments for the system, system component, or system service

system security plan

privacy plan

privacy program plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel with developer security testing responsibilities

system developers

independent verification agent

Test: Organizational processes for monitoring developer security testing and evaluation

mechanisms supporting and/or implementing the monitoring of developer security testing and evaluation
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-11 > SA-11(3) > Assessment Objective

SA-11(3) Independent Verification of Assessment Plans and Evidence - Assessment Objective
Determine if the following are satisfied:

SA-11(03)(a)[01] an independent agent is required to satisfy [Assignment: organization-defined independence criteria] to verify the correct implementation of the developer security assessment plan and the evidence produced during testing and evaluation;
SA-11(03)(a)[02] an independent agent is required to satisfy [Assignment: organization-defined independence criteria] to verify the correct implementation of the developer privacy assessment plan and the evidence produced during testing and evaluation;
SA-11(03)(b) the independent agent is provided with sufficient information to complete the verification process or granted the authority to obtain such information.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-11 > SA-11(4) > Assessment Methods

SA-11(4) Manual Code Reviews - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing system developer security testing

processes, procedures, and/or techniques for performing manual code reviews

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system developer security testing and evaluation plans

system developer security testing and evaluation results

list of code requiring manual reviews

records of manual code reviews

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with developer security testing responsibilities

system developers

independent verification agent

Test: Organizational processes for monitoring developer security testing and evaluation

mechanisms supporting and/or implementing the monitoring of developer testing and evaluation
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-11 > SA-11(4) > Assessment Objective

SA-11(4) Manual Code Reviews - Assessment Objective
Determine if the following are satisfied:

the developer of the system, system component, or system service is required to perform a manual code review of [Assignment: organization-defined specific code] using [Assignment: organization-defined processes, procedures, and/or techniques].
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-11 > SA-11(5) > Assessment Methods

SA-11(5) Penetration Testing - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

procedures addressing system developer security testing

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system developer penetration testing and evaluation plans

system developer penetration testing and evaluation results

system security plan

privacy plan

personally identifiable information processing policy

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel with developer security testing responsibilities

system developers

independent verification agent

Test: Organizational processes for monitoring developer security and privacy assessments

mechanisms supporting and/or implementing the monitoring of developer security and privacy assessments
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-11 > SA-11(5) > Assessment Objective

SA-11(5) Penetration Testing - Assessment Objective
Determine if the following are satisfied:

SA-11(05)(a)[01] the developer of the system, system component, or system service is required to perform penetration testing at the following level of rigor: [Assignment: organization-defined breadth];
SA-11(05)(a)[02] the developer of the system, system component, or system service is required to perform penetration testing at the following level of rigor: [Assignment: organization-defined depth];
SA-11(05)(b) the developer of the system, system component, or system service is required to perform penetration testing under [Assignment: organization-defined constraints].
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-11 > SA-11(6) > Assessment Methods

SA-11(6) Attack Surface Reviews - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing system developer security testing

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system developer security testing and evaluation plans

system developer security testing and evaluation results

records of attack surface reviews

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with developer security testing responsibilities

organizational personnel with configuration management responsibilities

system developers

Test: Organizational processes for monitoring developer security testing and evaluation

mechanisms supporting and/or implementing the monitoring of developer security testing and evaluation
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-11 > SA-11(6) > Assessment Objective

SA-11(6) Attack Surface Reviews - Assessment Objective
Determine if the following are satisfied:

the developer of the system, system component, or system service is required to perform attack surface reviews.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-11 > SA-11(7) > Assessment Methods

SA-11(7) Verify Scope of Testing and Evaluation - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing system developer security testing

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system developer security testing and evaluation plans

system developer security testing and evaluation results

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with developer security testing responsibilities

system developers

independent verification agent

Test: Organizational processes for monitoring developer security testing and evaluation

mechanisms supporting and/or implementing the monitoring of developer security testing and evaluation
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-11 > SA-11(7) > Assessment Objective

SA-11(7) Verify Scope of Testing and Evaluation - Assessment Objective
Determine if the following are satisfied:

SA-11(07)[01] the developer of the system, system component, or system service is required to verify that the scope of testing and evaluation provides complete coverage of the required controls at [Assignment: organization-defined breadth];
SA-11(07)[02] the developer of the system, system component, or system service is required to verify that the scope of testing and evaluation provides complete coverage of the required controls at [Assignment: organization-defined depth].
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-11 > SA-11(8) > Assessment Methods

SA-11(8) Dynamic Code Analysis - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing system developer security testing

procedures addressing flaw remediation

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system developer security test and evaluation plans

security test and evaluation results

security flaw and remediation tracking reports

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with developer security testing responsibilities

organizational personnel with configuration management responsibilities

system developers

Test: Organizational processes for monitoring developer security testing and evaluation

mechanisms supporting and/or implementing the monitoring of developer security testing and evaluation
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-11 > SA-11(8) > Assessment Objective

SA-11(8) Dynamic Code Analysis - Assessment Objective
Determine if the following are satisfied:

SA-11(08)[01] the developer of the system, system component, or system service is required to employ dynamic code analysis tools to identify common flaws;
SA-11(08)[02] the developer of the system, system component, or system service is required to document the results of the analysis.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-11 > SA-11(9) > Assessment Methods

SA-11(9) Interactive Application Security Testing - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing system developer security testing

procedures addressing interactive application security testing

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system developer security test and evaluation plans

security test and evaluation results

security flaw and remediation tracking reports

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with developer security testing responsibilities

organizational personnel with configuration management responsibilities

system developers

Test: Organizational processes for interactive application security testing

mechanisms supporting and/or implementing interactive application security testing
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-11 > SA-11(9) > Assessment Objective

SA-11(9) Interactive Application Security Testing - Assessment Objective
Determine if the following are satisfied:

SA-11(09)[01] the developer of the system, system component, or system service is required to employ interactive application security testing tools to identify flaws;
SA-11(09)[02] the developer of the system, system component, or system service is required to document the results of flaw identification.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > Assessment Methods

SA-15 Development Process, Standards, and Tools - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

procedures addressing development process, standards, and tools

procedures addressing the integration of security and privacy requirements during the development process

solicitation documentation

acquisition documentation

critical component inventory documentation

service level agreements

acquisition contracts for the system, system component, or system service

system developer documentation listing tool options/configuration guides

configuration management policy

configuration management records

documentation of development process reviews using maturity models

change control records

configuration control records

documented reviews of the development process, standards, tools, and tool options/configurations

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security and privacy responsibilities

system developer