Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

sa-15(6)

development process, standards, and tools  | continuous improvement

assessment objective:

Determine if the organization requires the developer of the information system, system component, or information system service to implement an explicit process to continuously improve the development process.

potential assessment methods and objects:

Examine: [select from: System and services acquisition policy; procedures addressing development process, standards, and tools; solicitation documentation; acquisition documentation; service-level agreements; acquisition contracts for the information system, system component, or information system service; quality goals and metrics for improving system development process; security assessments and/or quality control reviews of system development process; plans of action and milestones for improving system development process; other relevant documents or records].

Interview: [select from: Organizational personnel with system and services acquisition responsibilities; organizational personnel with information security responsibilities; system developer].