Navigate

CCI-003300

CCI-003300 Definition

The organization requires the developer of the information system, system component, or information system service to prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security policy when implemented.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed documents within contracts/agreements, the requirement that the developer of the information system, system component, or information system service prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security policy when implemented.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the contracts/agreements o ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security policy when implemented.

Compelling Evidence

1.) System security plan (SSP). 2.) System development life cycle (SDLC) documentation. 3.) Continuous monitoring plan requiring developers of the information system, system component, or information system service to prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security policy when implemented.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-003300.

Control	Description
SA-17 (1)	The organization requires the developer of the information system, system component, or information system service to: SA-17 (1)(a): Produce, as an integral part of the development process, a formal policy model describing the [Assignment: organization-defined elements of organizational security policy] to be enforced; and SA-17 (1)(b): Prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security policy when implemented.

Control

Description

SA-17 (1)

The organization requires the developer of the information system, system component, or information system service to:

SA-17 (1)(a): Produce, as an integral part of the development process, a formal policy model describing the [Assignment: organization-defined elements of organizational security policy] to be enforced; and

SA-17 (1)(b): Prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security policy when implemented.