Navigate

CCI-004702

CCI-004702 Definition

Defines the software development methods; testing; evaluation, assessment, verification, and validation methods, and quality control processes for demonstrating the use of a system development life cycle process.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes [SA-04(03)_ODP[05]; one or more of the following PARAMETER VALUES is/are selected: {[SA-04(03)_ODP[06]; software development methods are defined (if selected)]; [SA-04(03)_ODP[07]; testing, evaluation, assessment, verification, and validation methods are defined (if selected)]; [SA-04(03)_ODP[08]; quality control processes are defined (if selected)]}].

Validation Procedures

Examine: [SELECT FROM: System and services acquisition policy; system and services acquisition procedures; procedures addressing the integration of security and privacy requirements, descriptions, and criteria into the acquisition process; solicitation documents; acquisition documentation; acquisition contracts for the system, system component, or system service; list of systems security and privacy engineering methods to be included in the developerís system development life cycle process; list of software development methods to be included in the developerís system development life cycle process; list of testing, evaluation, or validation techniques to be included in the developerís system development life cycle process; list of quality control processes to be included in the developerís system development life cycle process; system security plan; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with acquisition/contracting responsibilities; organizational personnel with information security and privacy responsibilities; organizational personnel with system life cycle responsibilities; system developers or service provider]. Test: [SELECT FROM: Organizational processes for development methods, techniques, and processes].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-004702.

Control	Description
SA-4(3)	Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes: (a): [systems engineering methods are defined;]; (b): [one or more of "{{ insert: param, sa-04.03_odp.03 }} "/"{{ insert: param, sa-04.03_odp.04 }} "] ; and (c): [one or more of "{{ insert: param, sa-04.03_odp.06 }} "/"{{ insert: param, sa-04.03_odp.07 }} "/"{{ insert: param, sa-04.03_odp.08 }} "].

Control

Description

SA-4(3)

Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes:

(a): [systems engineering methods are defined;];

(b): [one or more of "{{ insert: param, sa-04.03_odp.03 }} "/"{{ insert: param, sa-04.03_odp.04 }} "] ; and

(c): [one or more of "{{ insert: param, sa-04.03_odp.06 }} "/"{{ insert: param, sa-04.03_odp.07 }} "/"{{ insert: param, sa-04.03_odp.08 }} "].