CCI-003259

CCI-003259 Definition

The organization defines the breadth/depth at which vulnerability analysis for the information system must be performed by developers.

Status
Type	CheckType.policy

The controls below (if any) were marked by NIST as being related to CCI-003259.

Control	Description
SA-15(4)	The organization requires that developers perform threat modeling and a vulnerability analysis for the information system at [one of ] that: (a): Uses [one of ]; (b): Employs [one of ]; and (c): Produces evidence that meets [one of ].