CCI-003270

CCI-003270 Definition

The organization defines the acceptance criteria that must be met when threat modeling of the information system is performed by the developer.

Status
Type	CheckType.policy

The controls below (if any) were marked by NIST as being related to CCI-003270.

Control	Description
SA-15(4)	The organization requires that developers perform threat modeling and a vulnerability analysis for the information system at [one of ] that: (a): Uses [one of ]; (b): Employs [one of ]; and (c): Produces evidence that meets [one of ].