CCI-003258

CCI-003258 Definition

The organization defines the breadth/depth at which threat modeling for the information system must be performed by developers.

Status
Type	CheckType.policy

The controls below (if any) were marked by NIST as being related to CCI-003258.

Control	Description
SA-15(4)	The organization requires that developers perform threat modeling and a vulnerability analysis for the information system at [one of ] that: (a): Uses [one of ]; (b): Employs [one of ]; and (c): Produces evidence that meets [one of ].