Navigate

SA-11(2)

SA-11(2): Threat and Vulnerability Analyses

The organization requires the developer of the information system, system component, or information system service to perform threat and vulnerability analyses and subsequent testing/evaluation of the as-built system, component, or service.

Supplemental

Applications may deviate significantly from the functional and design specifications created during the requirements and design phases of the system development life cycle. Therefore, threat and vulnerability analyses of information systems, system components, and information system services prior to delivery are critical to the effective operation of those systems, components, and services. Threat and vulnerability analyses at this phase of the life cycle help to ensure that design or implementation changes have been accounted for, and that any new vulnerabilities created as a result of those changes have been reviewed and mitigated.

CIA Levels
Confidentiality	high
Integrity	high
Availability	high

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to SA-11(2).

Control	Description
PM-15	The organization establishes and institutionalizes contact with selected groups and associations within the security community: a: To facilitate ongoing security education and training for organizational personnel; b: To maintain currency with recommended security practices, techniques, and technologies; and c: To share current security-related information including threats, vulnerabilities, and incidents.
RA-5	The organization: a: Scans for vulnerabilities in the information system and hosted applications [organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system/applications are identified and reported; b: Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: 1: Enumerating platforms, software flaws, and improper configurations; 2: Formatting checklists and test procedures; and 3: Measuring vulnerability impact; c: Analyzes vulnerability scan reports and results from security control assessments; d: Remediates legitimate vulnerabilities [organization-defined response times] in accordance with an organizational assessment of risk; and e: Shares information obtained from the vulnerability scanning process and security control assessments with [organization-defined personnel or roles] to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).

Control

Description

PM-15

The organization establishes and institutionalizes contact with selected groups and associations within the security community:

a: To facilitate ongoing security education and training for organizational personnel;

b: To maintain currency with recommended security practices, techniques, and technologies; and

c: To share current security-related information including threats, vulnerabilities, and incidents.

RA-5

The organization:

a: Scans for vulnerabilities in the information system and hosted applications [organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system/applications are identified and reported;

b: Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
- 1: Enumerating platforms, software flaws, and improper configurations;
- 2: Formatting checklists and test procedures; and
- 3: Measuring vulnerability impact;

c: Analyzes vulnerability scan reports and results from security control assessments;

d: Remediates legitimate vulnerabilities [organization-defined response times] in accordance with an organizational assessment of risk; and

e: Shares information obtained from the vulnerability scanning process and security control assessments with [organization-defined personnel or roles] to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).

Enhancements

The controls below (if any) add on to the requirements of SA-11(2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to SA-11(2).

CCI	Definition
CCI-003181	Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analyses during development.
CCI-003182	Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analysis during subsequent testing and evaluation of the system, component, or service.