Navigate

SA-11(3)

SA-11(3): Independent Verification of Assessment Plans / Evidence

The organization:

(a): Requires an independent agent satisfying [organization-defined independence criteria] to verify the correct implementation of the developer security assessment plan and the evidence produced during security testing/evaluation; and

(b): Ensures that the independent agent is either provided with sufficient information to complete the verification process or granted the authority to obtain such information.

Supplemental

Independent agents have the necessary qualifications (i.e., expertise, skills, training, and experience) to verify the correct implementation of developer security assessment plans.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to SA-11(3).

Control	Description
AT-3	The organization provides role-based security training to personnel with assigned security roles and responsibilities: a: Before authorizing access to the information system or performing assigned duties; b: When required by information system changes; and c: [organization-defined frequency] thereafter.
CA-7	The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes: a: Establishment of [organization-defined metrics] to be monitored; b: Establishment of [organization-defined frequencies] for monitoring and [organization-defined frequencies] for assessments supporting such monitoring; c: Ongoing security control assessments in accordance with the organizational continuous monitoring strategy; d: Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy; e: Correlation and analysis of security-related information generated by assessments and monitoring; f: Response actions to address results of the analysis of security-related information; and g: Reporting the security status of organization and the information system to [organization-defined personnel or roles] [organization-defined frequency].
RA-5	The organization: a: Scans for vulnerabilities in the information system and hosted applications [organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system/applications are identified and reported; b: Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: 1: Enumerating platforms, software flaws, and improper configurations; 2: Formatting checklists and test procedures; and 3: Measuring vulnerability impact; c: Analyzes vulnerability scan reports and results from security control assessments; d: Remediates legitimate vulnerabilities [organization-defined response times] in accordance with an organizational assessment of risk; and e: Shares information obtained from the vulnerability scanning process and security control assessments with [organization-defined personnel or roles] to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).
SA-12	The organization protects against supply chain threats to the information system, system component, or information system service by employing [organization-defined security safeguards] as part of a comprehensive, defense-in-breadth information security strategy.

Enhancements

The controls below (if any) add on to the requirements of SA-11(3).

Control	Description
No controls

Related CCIs

The CCIs below are tied to SA-11(3).

CCI	Definition
CCI-003183	Require an independent agent satisfying organization-defined independence criteria to verify the correct implementation of the developer security assessment plan.
CCI-003184	Require an independent agent satisfying organization-defined independence criteria to verify the evidence produced during security testing and evaluation.
CCI-003185	Defines the independence criteria the independent agent must satisfy prior to verifying the correct implementation of the developer security assessment plan and the evidence produced during security testing and evaluation.
CCI-003186	Verify that the independent agent either is provided with sufficient information to complete the verification process or has been granted the authority to obtain such information.