SA-17 Developer Security and Privacy Architecture and Design. Require the developer of the system, system component, or system service to produce a design specification and security and privacy architecture that: Is consistent with the organization's
Developer Security and Privacy Architecture and Design. Require the developer of the system, system component, or system service to produce a design specification and security and privacy architecture that: Is consistent.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence the architecture expresses the allocation of functionality among components and the design rationale · Cloud console / configuration management
- Organisational review and acceptance of the delivered architecture · Cloud console / configuration management
governing documentDocuments that govern the control
- Contract requirement for the developer to produce a design specification and security and privacy architecture · Vendor register / contract repository
- The delivered architecture, showing consistency with the organisation's enterprise architecture · Policy repository / GRC workspace
- Documentation of how the architecture accurately and completely describes the required security and privacy functionality · Policy repository / GRC workspace
First move
Common gaps auditors find
- Developer supplies a solution diagram rather than a security and privacy architecture with allocation and rationale
- No check for consistency with the organisation's enterprise architecture, so the delivered design conflicts with it
- Architecture accepted without review, so gaps surface only at assessment
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSA-16 Developer-provided Training. Require the developer of the system, system component, or system service to provide the following training on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms: · SA-20 Customized Development of Critical Components. Reimplement or custom develop the following critical system components: [organization-defined]