zydronium/manage.get.gov
1
0
Fork 0
mirror of https://github.com/cisagov/manage.get.gov.git synced 2025-08-03 16:32:15 +02:00
Code Issues Projects Releases Packages Wiki Activity
manage.get.gov/docs/compliance/dist/system-security-plans/ato/sa-10.md
Logan McDonald 1d3dfdb8d5
Add compliance documentation to source control (#116) 
* add initial setup of compliance-trestle
2022-09-14 08:46:43 -04:00

4.8 KiB
Raw Blame History

implementation-status control-origination
c-not-implemented
c-inherited-cloud-gov
c-inherited-cisa
c-common-control
c-system-specific-control

sa-10 - [catalog] Developer Configuration Management

Control Statement

Require the developer of the system, system component, or system service to:

  • [a] Perform configuration management during system, component, or service No value found;

  • [b] Document, manage, and control the integrity of changes to configuration items;

  • [c] Implement only organization-approved changes to the system, component, or service;

  • [d] Document approved changes to the system, component, or service and the potential security and privacy impacts of such changes; and

  • [e] Track security flaws and flaw resolution within the system, component, or service and report findings to personnel.

Control guidance

Organizations consider the quality and completeness of configuration management activities conducted by developers as direct evidence of applying effective security controls. Controls include protecting the master copies of material used to generate security-relevant portions of the system hardware, software, and firmware from unauthorized modification or destruction. Maintaining the integrity of changes to the system, system component, or system service requires strict configuration control throughout the system development life cycle to track authorized changes and prevent unauthorized changes.

The configuration items that are placed under configuration management include the formal model; the functional, high-level, and low-level design specifications; other design data; implementation documentation; source code and hardware schematics; the current running version of the object code; tools for comparing new versions of security-relevant hardware descriptions and source code with previous versions; and test fixtures and documentation. Depending on the mission and business needs of organizations and the nature of the contractual relationships in place, developers may provide configuration management support during the operations and maintenance stage of the system development life cycle.

Control assessment-objective

the developer of the system, system component, or system service is required to perform configuration management during system, component, or service No value found; the developer of the system, system component, or system service is required to document the integrity of changes to configuration items; the developer of the system, system component, or system service is required to manage the integrity of changes to configuration items; the developer of the system, system component, or system service is required to control the integrity of changes to configuration items; the developer of the system, system component, or system service is required to implement only organization-approved changes to the system, component, or service; the developer of the system, system component, or system service is required to document approved changes to the system, component, or service; the developer of the system, system component, or system service is required to document the potential security impacts of approved changes; the developer of the system, system component, or system service is required to document the potential privacy impacts of approved changes; the developer of the system, system component, or system service is required to track security flaws within the system, component, or service; the developer of the system, system component, or system service is required to track security flaw resolutions within the system, component, or service; the developer of the system, system component, or system service is required to report findings to personnel.

What is the solution and how is it implemented?

Implementation a.

Add control implementation description here for item sa-10_smt.a

Implementation b.

Add control implementation description here for item sa-10_smt.b

Implementation c.

Add control implementation description here for item sa-10_smt.c

Implementation d.

Add control implementation description here for item sa-10_smt.d

Implementation e.

Add control implementation description here for item sa-10_smt.e