SA-11 (4)
SA-11 (4): Manual Code Reviews
The organization requires the developer of the information system, system component, or information system service to perform a manual code review of [Assignment: organization-defined specific code] using [Assignment: organization-defined processes, procedures, and/or techniques].
Supplemental
Manual code reviews are usually reserved for the critical software and firmware components of information systems. Such code reviews are uniquely effective at identifying weaknesses that require knowledge of the application�s requirements or context which are generally unavailable to more automated analytic tools and techniques such as static or dynamic analysis. Components benefiting from manual review include for example, verifying access control matrices against application controls and reviewing more detailed aspects of cryptographic implementations and controls.
| CIA Levels | |
|---|---|
| Confidentiality | unknown |
| Integrity | unknown |
| Availability | unknown |
| Overlays |
|---|
| None |