CCI-003243

Review the development tools in accordance with organization-defined frequency to determine if the development tools selected and employed can satisfy organization-defined security requirements.

Implementation Guidance

The organization being inspected/assessed documents and implements a process to review the development tools before first use and annually thereafter to determine if the development tools selected and employed can satisfy the security requirements defined in SA-15, CCI 3246. The organization must maintain a record of reviews. DoD has defined the frequency as before first use and annually thereafter.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of reviews to ensure the organization being inspected/assessed reviews the development tools before first use and annually thereafter to determine if the development tools selected and employed can satisfy the security requirements defined in SA-15, CCI 3246. DoD has defined the frequency as before first use and annually thereafter.

Compelling Evidence

1.) System security plan (SSP). 2.) System development life cycle (SDLC) documentation. 3.) Continuous monitoring plan for reviewing the organization-defined frequency to ensure the development process selected and employed can satisfy organization-defined security requirements.

The controls below (if any) were marked by NIST as being related to CCI-003243.