Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

sa-10(1)

developer configuration management  | software / firmware integrity verification

assessment objective:

Determine if the organization requires the developer of the information system, system component, or information system service to enable integrity verification of software and firmware components.

potential assessment methods and objects:

Examine: [select from: System and services acquisition policy; procedures addressing system developer configuration management; solicitation documentation; acquisition documentation; service-level agreements; acquisition contracts for the information system; system component, or information system service; system developer configuration management plan; software and firmware integrity verification records; system change authorization records; change control records; configuration management records; other relevant documents or records].

Interview: [select from: Organizational personnel with system and services acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel with configuration management responsibilities; system developers].

Test: [select from: Organizational processes for monitoring developer configuration management; automated mechanisms supporting and/or implementing the monitoring of developer configuration management].