← SA-11 (2) — Threat Modeling and Vulnerability Analyses

CCI-003182

Definition

Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analysis during subsequent testing and evaluation of the system, component, or service.

Parent Control

SA-11 (2)Threat Modeling and Vulnerability AnalysesSystem and Services Acquisition

Linked STIG Checks (2)

V-222646CAT IIAt least one tester must be designated to test for security flaws in addition to functional testing.Application Security and Development Security Technical Implementation Guide V-222647CAT IIITest procedures must be created and at least annually executed to ensure system initialization, shutdown, and aborts are configured to verify the system remains in a secure state.Application Security and Development Security Technical Implementation Guide