Navigate

SA-17 (6)

SA-17 (6): Structure For Testing

The organization requires the developer of the information system, system component, or information system service to structure security-relevant hardware, software, and firmware to facilitate testing.

Supplemental

None

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
Cross Domain (Access), Cross Domain (Multilevel), Cross Domain (Transfer)

Related Controls

The controls below (if any) were marked by NIST as being related to SA-17 (6).

Control	Description
SA-11	The organization requires the developer of the information system, system component, or information system service to: SA-11a.: Create and implement a security assessment plan; SA-11b.: Perform [Selection (one or more): unit; integration; system; regression] testing/evaluation at [Assignment: organization-defined depth and coverage]; SA-11c.: Produce evidence of the execution of the security assessment plan and the results of the security testing/evaluation; SA-11d.: Implement a verifiable flaw remediation process; and SA-11e.: Correct flaws identified during security testing/evaluation.

Control

Description

SA-11

The organization requires the developer of the information system, system component, or information system service to:

SA-11a.: Create and implement a security assessment plan;

SA-11b.: Perform [Selection (one or more): unit; integration; system; regression] testing/evaluation at [Assignment: organization-defined depth and coverage];

SA-11c.: Produce evidence of the execution of the security assessment plan and the results of the security testing/evaluation;

SA-11d.: Implement a verifiable flaw remediation process; and

SA-11e.: Correct flaws identified during security testing/evaluation.

Enhancements

The controls below (if any) add on to the requirements of SA-17 (6).

Control	Description
No controls

Related CCIs

The CCIs below are tied to SA-17 (6).

CCI	Definition
CCI-003340	The organization requires the developer of the information system, component, or information system service to structure security-relevant hardware to facilitate testing.
CCI-003341	The organization requires the developer of the information system, component, or information system service to structure security-relevant software to facilitate testing.
CCI-003342	The organization requires the developer of the information system, component, or information system service to structure security-relevant firmware to facilitate testing.