Title

Application code must go through a code review prior to deployment into DoD operational networks. (Cat II impact)

Discussion

Prior to release of the application receiving an IATO for deployment into a DoD operational network, the application will have a thorough code review. Along with the proper testing, the code review will specify flaws causing security, compatibility, or reliability concerns that may compromise the operational network.

Check Content

Determine whether there is a policy in place for code review prior to applications being deployed into a DoD operational network. If a code review policy has not been established, this is a finding. If there isn't any application development occurring in the zone environment, this requirement is not applicable.

Fix Text

Implement a code review policy for applications before deployment into DoD operational networks.

Additional Identifiers

Rule ID: SV-51472r1_rule

Vulnerability ID: V-39614

Group Title: ENTD0130 - Code review not completed prior to application deployment.

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.