STIGhub
STIGs
RMF Controls
Compare
← All Controls
SA-15 (4)
System and Services Acquisition
Rev 5
Withdrawn
Threat Modeling and Vulnerability Analysis
This control has been withdrawn and incorporated into:
SA-11 (2)
CCI Identifiers (16)
CCI-003263
The organization defines information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used to perform a vulnerability analysis for the information system by the developer.
CCI-003266
The organization defines tools and methods to be employed to perform threat modeling for the information system by the developer.
CCI-003267
The organization defines tools and methods to be employed to perform a vulnerability analysis for the information system by the developer.
CCI-003268
The organization requires that developers performing threat modeling for the information system produce evidence that meets organization-defined acceptance criteria.
CCI-003271
The organization defines the acceptance criteria that must be met when vulnerability analysis of the information system is performed by the developer.
CCI-003261
Vulnerability analysis performed by the developer for the information system uses organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels.
CCI-003264
The organization requires the threat modeling performed by the developers employ organization-defined tools and methods.
CCI-003270
The organization defines the acceptance criteria that must be met when threat modeling of the information system is performed by the developer.
CCI-003259
The organization defines the breadth/depth at which vulnerability analysis for the information system must be performed by developers.
CCI-003262
The organization defines information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used to perform threat modeling for the information system by the developer.
CCI-003265
The organization requires the vulnerability analysis performed by the developers employ organization-defined tools and methods.
CCI-003260
Threat modeling performed by the developer for the information system uses organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels.
CCI-003269
The organization requires that developers performing vulnerability analysis for the information system produce evidence that meets organization-defined acceptance criteria.
CCI-003258
The organization defines the breadth/depth at which threat modeling for the information system must be performed by developers.
CCI-003256
The organization requires that developers perform threat modeling for the information system at an organization-defined breadth/depth.
CCI-003257
The organization requires that developers perform a vulnerability analysis for the information system at an organization-defined breadth/depth.
Linked STIG Checks (1)
Across 1 STIGs. Click to expand.
▶
Application Security and Development Security Technical Implementation Guide
1 check