contracts/agreements to Therefore, this ensure the organization AP is not being inspected/assessed applicable. requires that the developers perform threat modeling for the information system at the breadth/depth defined in SA-15 (4), CCI 3258. SA-15 SA-15 (4) CCI-003257 High High High The organization conducting The system is not (4) the inspection/assessment considered a obtains and examines the HIGH contracts/agreements to Therefore, this ensure the organization AP is not being inspected/assessed applicable. requires that the developers perform a vulnerability analysis for the information system at the breadth/depth defined in SA-15 (4), CCI 3259. SA-15 SA-15 (4) CCI-003258 High High High The organization conducting The system is not (4) the inspection/assessment considered a obtains and examines the HIGH level. contracts/agreements to Therefore, this ensure the organization AP is not inspected/assessed requires applicable. that the developers perform threat modeling for the information system at the breadth/depth defined in SA-15 (4), CCI 3258. SA-15 SA-15 (4) CCI-003259 High High High The organization conducting The system is not (4) the inspection/assessment considered a obtains and examines the HIGH level. contracts/agreements to Therefore, this ensure the organization AP is not being inspected/assessed applicable. requires that the developers perform a vulnerability analysis for the information system at the breadth/depth defined in SA-15 (4), CCI 3259. SA-15 SA-15 (4) (a) CCI-003260 High High High The organization conducting The system is not (4) the inspection/assessment considered a obtains and examines the HIGH level. contracts/agreements to Therefore, this ensure the organization AP is not being inspected/assessed applicable. documents within their contracts/agreements, their requirement that the developer's threat modeling include the use of information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels defined in SA-15 (4), CCI 3262. SA-15 SA-15 (4) (a) CCI-003261 High High High The organization conducting The system is not (4) the inspection/assessment considered a
contracts/agreements to ensure the organization being inspected/assessed requires that the developers perform threat modeling for the information system at the breadth/depth defined in SA-15 (4), CCI 3258. Therefore, this AP is not applicable. SA-15 (4) SA-15 (4) CCI-003257 High High High The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developers perform a vulnerability analysis for the information system at the breadth/depth defined in SA-15 (4), CCI 3259. The system is not considered a HIGH Therefore, this AP is not applicable. SA-15 (4) SA-15 (4) CCI-003258 High High High The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization inspected/assessed requires that the developers perform threat modeling for the information system at the breadth/depth defined in SA-15 (4), CCI 3258. The system is not considered a HIGH level. Therefore, this AP is not applicable. SA-15 (4) SA-15 (4) CCI-003259 High High High The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developers perform a vulnerability analysis for the information system at the breadth/depth defined in SA-15 (4), CCI 3259. The system is not considered a HIGH level. Therefore, this AP is not applicable. SA-15 (4) SA-15 (4) (a) CCI-003260 High High High The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed documents within their contracts/agreements, their requirement that the developer's threat modeling include the use of information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels defined in SA-15 (4), CCI 3262. The system is not considered a HIGH level. Therefore, this AP is not applicable. SA-15 (4) SA-15 (4) (a) CCI-003261 High High High The organization conducting the inspection/assessment The system is not considered a