CCI-003260

Threat modeling performed by the developer for the information system uses organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels.

Implementation Guidance

The organization being inspected/assessed requires within contracts/agreements that the developer's threat modeling include the use of information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels defined in SA-15 (4), CCI 3262.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed documents within their contracts/agreements, their requirement that the developer's threat modeling include the use of information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels defined in SA-15 (4), CCI 3262.

Compelling Evidence

1.) System security plan (SSP). 2.) System development life cycle (SDLC) documentation. 3.) Continuous monitoring plan requiring that threat modeling performed by developers for the information system uses organization-defined information concerning impact, environment of operations, known or assumed threats and acceptable risk levels.

The controls below (if any) were marked by NIST as being related to CCI-003260.