Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

sa-21(1)

developer screening  | validation of screening

assessment objective:

Determine if the organization:

sa-21(1)[1]

defines actions to be taken by the developer of the information system, system component, or information system service to ensure that the required access authorizations and screening criteria are satisfied; and

sa-21(1)[2]

requires the developer of the information system, system component, or information system service take organization-defined actions to ensure that the required access authorizations and screening criteria are satisfied.

potential assessment methods and objects:

Examine: [select from: System and services acquisition policy; personnel security policy and procedures; procedures addressing personnel screening; information system design documentation; information system configuration settings and associated documentation; list of appropriate access authorizations required by developers of the information system; personnel screening criteria and associated documentation; list of actions ensuring required access authorizations and screening criteria are satisfied; other relevant documents or records].

Interview: [select from: Organizational personnel with system and services acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel with responsibility for developer screening; system developer].

Test: [select from: Organizational processes for developer screening; automated mechanisms supporting developer screening].