CCI-004848

Use different designs for organization-defined critical systems or system components to satisfy a common set of requirements or to provide equivalent functionality.

Implementation Guidance

Determine if different designs are used for [SA-17(09)_ODP; critical systems or system components to be designed differently are defined] to satisfy a common set of requirements or to provide equivalent functionality.

Validation Procedures

Examine: [SELECT FROM: System and services acquisition policy; enterprise architecture policy; procedures addressing developer security architecture and design diversity for the system; solicitation documentation; acquisition documentation; service level agreements; acquisition contracts for the system, system component, or system service; system design documentation; system security architecture documentation; system configuration settings and associated documentation; developer documentation describing design diversity; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with system and service acquisition responsibilities; organizational personnel with information security responsibilities; system developer; organizational personnel with information security architecture responsibilities].

The controls below (if any) were marked by NIST as being related to CCI-004848.