CCI-003244

Review the development tool options/configurations in accordance with organization-defined frequency to determine if the development tool options and tool configurations selected and employed can satisfy organization-defined security requirements.

Implementation Guidance

The organization being inspected/assessed documents and implements a process to review the development tool options/configurations before first use and annually thereafter to determine if the development tool options/configurations selected and employed can satisfy the security requirements defined in SA-15, CCI 3246. The organization must maintain a record of reviews. DoD has defined the frequency as before first use and annually thereafter.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of reviews to ensure the organization being inspected/assessed reviews the development tool options/configurations before first use and annually thereafter to determine if the development tool options/configurations selected and employed can satisfy the security requirements defined in SA-15, CCI 3246. DoD has defined the frequency as before first use and annually thereafter.

Compelling Evidence

1.) System security plan (SSP). 2.) System development life cycle (SDLC) documentation. 3.) Continuous monitoring plan for reviewing the development tool options/configurations in accordance with organization-defined frequency to determine if the development tool options/configurations selected and employed satisfy the organization-defined security requirements.

The controls below (if any) were marked by NIST as being related to CCI-003244.