CCI-004824

Require the developer of the system, system component, or system service to employ a privacy tracking tool for use during the development process.

Implementation Guidance

Determine if: - the developer of the system, system component, or system service is required to select and employ security tracking tools for use during the development process. - the developer of the system, system component, or system service is required to select and employ privacy tracking tools for use during the development process.

Validation Procedures

Examine: [SELECT FROM: System and services acquisition policy; system and services acquisition procedures; procedures addressing development process, standards, and tools; procedures addressing the integration of security and privacy requirements into the acquisition process; solicitation documentation; acquisition documentation; service level agreements; acquisition contracts for the system, system component, or system service; documentation of the selection of security and privacy tracking tools; evidence of employing security and privacy tracking tools; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with system and service acquisition responsibilities; organizational personnel with information security responsibilities; system developer; organizational personnel with privacy responsibilities].

The controls below (if any) were marked by NIST as being related to CCI-004824.