System and Services Acquisition (SA)

Require the developer of the system, system component, or system service to perform penetration testing: (a) At the following level of rigor: [Assignment: organization-defined breadth and depth of testing]; and (b) Under the following constraints: [Assignment: organization-defined constraints].


Login

System and Services Acquisition (SA)

Require the developer of the system, system component, or system service to perform attack surface reviews.


Login

System and Services Acquisition (SA)

Require the developer of the system, system component, or system service to verify that the scope of testing and evaluation provides complete coverage of the required controls at the following level of rigor: [Assignment: organization-defined breadth and depth of testing and evaluation].


Login

System and Services Acquisition (SA)

Require the developer of the system, system component, or system service to employ dynamic code analysis tools to identify common flaws and document the results of the analysis.


Login

System and Services Acquisition (SA)

Require the developer of the system, system component, or system service to employ interactive application security testing tools to identify flaws and document the results.


Login

System and Services Acquisition (SA)

[Withdrawn: Moved to SR-6.]


Login

System and Services Acquisition (SA)

[Withdrawn: Incorporated into SR-3.]


Login

System and Services Acquisition (SA)

[Withdrawn: Moved to SR-3(1).]


Login

System and Services Acquisition (SA)

[Withdrawn: Moved to SR-3(2).]


Login

System and Services Acquisition (SA)

[Withdrawn: Incorporated into SR-5(1).]


Login