Navigate

CCI-003092

CCI-003092 Definition

The organization defines a system development life cycle that is used to manage the information system.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed defines and documents a system development life cycle that is used to manage the information system. DoD has determined the system development life cycle is not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented system development life cycle to ensure the organization being inspected/assessed defines a system development life cycle that is used to manage the information system. DoD has determined the system development life cycle is not appropriate to define at the Enterprise level.

Compelling Evidence

1.) System Development Life Cycle (SDLC) documentation used to manage the information system.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-003092.

Control	Description
SA-3	The organization: SA-3a.: Manages the information system using [Assignment: organization-defined system development life cycle] that incorporates information security considerations; SA-3b.: Defines and documents information security roles and responsibilities throughout the system development life cycle; SA-3c.: Identifies individuals having information security roles and responsibilities; and SA-3d.: Integrates the organizational information security risk management process into system development life cycle activities.

Control

Description

SA-3

The organization:

SA-3a.: Manages the information system using [Assignment: organization-defined system development life cycle] that incorporates information security considerations;

SA-3b.: Defines and documents information security roles and responsibilities throughout the system development life cycle;

SA-3c.: Identifies individuals having information security roles and responsibilities; and

SA-3d.: Integrates the organizational information security risk management process into system development life cycle activities.