CCI-003174

Defines the depth and coverage at which to perform unit, integration, system, and/or regression testing/evaluation on an organization-defined frequency.

Implementation Guidance

The organization being inspected/assessed defines and documents the depth and coverage to perform unit, integration, system, and/or regression testing/evaluation. Examples of approaches or tool types that could be required are: 1. Approaches such as static analyses, dynamic analyses, binary analysis, or a hybrid of the three approaches; and 2. Tools such as web-based application scanners, static analysis tools, binary analyzers. DoD has determined the depth and coverage are not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented depth and coverage to ensure the organization being inspected/assessed defines the depth and coverage to perform unit, integration, system, and/or regression testing/evaluation. DoD has determined the depth and coverage are not appropriate to define at the Enterprise level.

Compelling Evidence

1.) System security plan (SSP). 2.) System development life cycle (SDLC) documentation must define organization depth and coverage of unit, integration, system, and/or regression testing for developer to perform.

The controls below (if any) were marked by NIST as being related to CCI-003174.