SA-11 : DEVELOPER SECURITY TESTING

FAMILY: System and Services Acquisition

CLASS: Management

SA-11 : DEVELOPER SECURITY TESTING

The organization requires that information system developers/integrators, in consultation with associated security personnel (including security engineers):

a. Create and implement a security test and evaluation plan;

b. Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the security testing and evaluation process; and

c. Document the results of the security testing/evaluation and flaw remediation processes.

Developmental security test results are used to the greatest extent feasible after verification of the results and recognizing that these results are impacted whenever there have been security-relevant modifications to the information system subsequent to developer testing. Test results may be used in support of the security authorization process for the delivered information system. Related control: CA-2, SI-2.

Control Enhancements:

References: None.

Priority and Baseline Allocation:

P2

LOW SA-11 Not Selected

MOD SA-11

HIGH SA-11