Navigate

CCI-003275

CCI-003275 Definition

Require the developer of the system, system component, or system services, on an organization-defined frequency, to perform an automated vulnerability analysis using organization-defined tools.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if the developer of the system, system component, or system service is required to perform automated vulnerability analysis [SA-15(07)_ODP[01]; frequency at which to conduct vulnerability analysis is defined] using [SA-15(07)_ODP[02]; tools used to perform automated vulnerability analysis are defined].

Validation Procedures

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing development process, standards, and tools; solicitation documentation; acquisition documentation; service level agreements; acquisition contracts for the system, system component, or system service; vulnerability analysis tools and associated documentation; risk assessment reports; vulnerability analysis results; vulnerability mitigation reports; risk mitigation strategy documentation; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with system and service acquisition responsibilities; organizational personnel with information security responsibilities; system developer; organizational personnel performing automated vulnerability analysis on the system]. Test: [SELECT FROM: Organizational processes for vulnerability analysis of systems, system components, or system services under development; mechanisms supporting and/or implementing vulnerability analysis of systems, system components, or system services under development].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-003275.

Control	Description
SA-15(7)	Require the developer of the system, system component, or system service [frequency at which to conduct vulnerability analysis is defined;] to: (a): Perform an automated vulnerability analysis using [tools used to perform automated vulnerability analysis are defined;]; (b): Determine the exploitation potential for discovered vulnerabilities; (c): Determine potential risk mitigations for delivered vulnerabilities; and (d): Deliver the outputs of the tools and results of the analysis to [personnel or roles to whom the outputs of tools and results of the analysis are to be delivered is/are defined;].

Control

Description

SA-15(7)

Require the developer of the system, system component, or system service [frequency at which to conduct vulnerability analysis is defined;] to:

(a): Perform an automated vulnerability analysis using [tools used to perform automated vulnerability analysis are defined;];

(b): Determine the exploitation potential for discovered vulnerabilities;

(c): Determine potential risk mitigations for delivered vulnerabilities; and

(d): Deliver the outputs of the tools and results of the analysis to [personnel or roles to whom the outputs of tools and results of the analysis are to be delivered is/are defined;].