Question 1

What evidence do auditors ask for on SA-20 Customized Development of Critical Components. Reimplement or custom develop the following critical system components: [organization-defined]?

Accepted Answer

The defined list of critical system components to be reimplemented or custom developed, with the criticality rationale; Development records for those components under the organisation's secure development life cycle; Evidence of why the commercially available component was unacceptable, linking to a supply chain risk finding; Assurance evidence for the custom component, such as design review and testing results; Ongoing maintenance ownership for the custom component.

Question 2

Can SA-20 be evidenced continuously rather than by periodic review?

Accepted Answer

This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.

Question 3

What is the most common gap auditors find on SA-20?

Accepted Answer

Criticality rationale absent, so the choice to custom develop cannot be justified or bounded

`SA-20` Customized Development of Critical Components. Reimplement or custom develop the following critical system components: [organization-defined]

system holds itEvidence a system already holds

periodic reviewEvidence produced at each review

governing documentDocuments that govern the control

First move

Common gaps auditors find

Do this for your whole sheet