Navigate

CCI-003105

CCI-003105 Definition

Defines the level of detail for the design information of the controls that is required to be provided by the developer of the information system, system component, or information system services.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed defines and documents the level of detail the design information of the security controls is required to be provided by the developer of the information system, system component, or information system services. DoD has determined the level of detail is not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented level of detail to ensure the organization being inspected/assessed defines the level of detail the design information of the security controls is required to be provided by the developer of the information system, system component, or information system services. DoD has determined the level of detail is not appropriate to define at the Enterprise level.

Compelling Evidence

1.) System security plan (SSP) defines level of detail required in design information of all security controls, to be provided by developer of information system, component, or service.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-003105.

Control	Description
SA-4(2)	The organization requires the developer of the information system, system component, or information system service to provide design and implementation information for the security controls to be employed that includes: [one or more of security-relevant external system interfaces/high-level design/low-level design/source code or hardware schematics/ {{ insert: param, sa-4.2_prm_2 }} ] at [organization-defined level of detail].

Control

Description

SA-4(2)

The organization requires the developer of the information system, system component, or information system service to provide design and implementation information for the security controls to be employed that includes: [one or more of security-relevant external system interfaces/high-level design/low-level design/source code or hardware schematics/ {{ insert: param, sa-4.2_prm_2 }} ] at [organization-defined level of detail].