Navigate

SA-11 (2)

SA-11 (2): Threat And Vulnerability Analyses

The organization requires the developer of the information system, system component, or information system service to perform threat and vulnerability analyses and subsequent testing/evaluation of the as-built system, component, or service.

Supplemental

Applications may deviate significantly from the functional and design specifications created during the requirements and design phases of the system development life cycle. Therefore, threat and vulnerability analyses of information systems, system components, and information system services prior to delivery are critical to the effective operation of those systems, components, and services. Threat and vulnerability analyses at this phase of the life cycle help to ensure that design or implementation changes have been accounted for, and that any new vulnerabilities created as a result of those changes have been reviewed and mitigated.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
Cross Domain (Access), Cross Domain (Multilevel), Cross Domain (Transfer), Space Platform

Related Controls

The controls below (if any) were marked by NIST as being related to SA-11 (2).

Control	Description
PM-15	The organization establishes and institutionalizes contact with selected groups and associations within the security community: PM-15a.: To facilitate ongoing security education and training for organizational personnel; PM-15b.: To maintain currency with recommended security practices, techniques, and technologies; and PM-15c.: To share current security-related information including threats, vulnerabilities, and incidents.
RA-5	The organization: RA-5a.: Scans for vulnerabilities in the information system and hosted applications [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system/applications are identified and reported; RA-5b.: Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: RA-5b.1.: Enumerating platforms, software flaws, and improper configurations; RA-5b.2.: Formatting checklists and test procedures; and RA-5b.3.: Measuring vulnerability impact; RA-5c.: Analyzes vulnerability scan reports and results from security control assessments; RA-5d.: Remediates legitimate vulnerabilities [Assignment: organization-defined response times] in accordance with an organizational assessment of risk; and RA-5e.: Shares information obtained from the vulnerability scanning process and security control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).

Control

Description

PM-15

The organization establishes and institutionalizes contact with selected groups and associations within the security community:

PM-15a.: To facilitate ongoing security education and training for organizational personnel;

PM-15b.: To maintain currency with recommended security practices, techniques, and technologies; and

PM-15c.: To share current security-related information including threats, vulnerabilities, and incidents.

RA-5

The organization:

RA-5a.: Scans for vulnerabilities in the information system and hosted applications [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system/applications are identified and reported;

RA-5b.: Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
- RA-5b.1.: Enumerating platforms, software flaws, and improper configurations;
- RA-5b.2.: Formatting checklists and test procedures; and
- RA-5b.3.: Measuring vulnerability impact;

RA-5c.: Analyzes vulnerability scan reports and results from security control assessments;

RA-5d.: Remediates legitimate vulnerabilities [Assignment: organization-defined response times] in accordance with an organizational assessment of risk; and

RA-5e.: Shares information obtained from the vulnerability scanning process and security control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).

Enhancements

The controls below (if any) add on to the requirements of SA-11 (2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to SA-11 (2).

CCI	Definition
CCI-003181	The organization requires the developer of the information system, system component, or information system service to perform threat and vulnerability analysis.
CCI-003182	The organization requires the developer of the information system, system component, or information system service to perform testing/evaluation of the as-built system, component, or service subsequent to threat and vulnerability analysis.