CCI-003261

Vulnerability analysis performed by the developer for the information system uses organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels.

Implementation Guidance

The organization being inspected/assessed requires within contracts/agreements that the developer's vulnerability analysis include the use of information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels defined in SA-15 (4), CCI 3263. Vulnerability analysis should consider a review of system design and may include static analyses, dynamic analyses, simulations, and penetration testing. The developer should document the type of vulnerability analysis that was performed, the results (including defects) and any follow on actions.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed documents within their contracts/agreements, their requirement that the developer's vulnerability analysis include the use of information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels defined in SA-15 (4), CCI 3263.

Compelling Evidence

1.) System security plan (SSP). 2.) System development life cycle (SDLC) documentation. 3.) Continuous monitoring plan requiring that vulnerability analysis performed by developers for the information system uses organization-defined information concerning impact, environment of operations, known or assumed threats and acceptable risk levels.

The controls below (if any) were marked by NIST as being related to CCI-003261.