Navigate

CCI-003297

CCI-003297 Definition

Require the developer of the system, system component, or system service to produce a design specification and security architecture that expresses how individual security functions, mechanisms, and services work together to provide required security capabilities and a unified approach to protection.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if: - the developer of the system, system component, or system service is required to produce a design specification and security architecture that express how individual security functions, mechanisms, and services work together to provide required security capabilities and a unified approach to protection. - the developer of the system, system component, or system service is required to produce a design specification and privacy architecture that express how individual privacy functions, mechanisms, and services work together to provide required privacy capabilities and a unified approach to protection.

Validation Procedures

Examine: [SELECT FROM: System and services acquisition policy; system and services acquisition procedures; enterprise architecture policy; enterprise architecture documentation; procedures addressing developer security and privacy architecture and design specifications for the system; solicitation documentation; acquisition documentation; service level agreements; acquisition contracts for the system, system component, or system service; system design documentation; information system configuration settings and associated documentation; system security plan; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with acquisition responsibilities; organizational personnel with information security and privacy responsibilities; system developer].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-003297.

Control	Description
SA-17	Require the developer of the system, system component, or system service to produce a design specification and security and privacy architecture that: a: Is consistent with the organization’s security and privacy architecture that is an integral part the organization’s enterprise architecture; b: Accurately and completely describes the required security and privacy functionality, and the allocation of controls among physical and logical components; and c: Expresses how individual security and privacy functions, mechanisms, and services work together to provide required security and privacy capabilities and a unified approach to protection.

Control

Description

SA-17

Require the developer of the system, system component, or system service to produce a design specification and security and privacy architecture that:

a: Is consistent with the organization’s security and privacy architecture that is an integral part the organization’s enterprise architecture;

b: Accurately and completely describes the required security and privacy functionality, and the allocation of controls among physical and logical components; and

c: Expresses how individual security and privacy functions, mechanisms, and services work together to provide required security and privacy capabilities and a unified approach to protection.