Part d Part e Developer Security Testing (SA-11) The organization requires that information system developers/integrators, in consultation with associated security personnel (including security engineers): Create and implement a security test and evaluation plan; Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the security testing and evaluation process; and Document the results of the security testing/evaluation and flaw remediation processes. SA-11 Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> SA-11 What is the solution and how is it implemented?
Part d Part e Developer Security Testing (SA-11) The organization requires that information system developers/integrators, in consultation with associated security personnel (including security engineers): Create and implement a security test and evaluation plan; Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the security testing and evaluation process; and Document the results of the security testing/evaluation and flaw remediation processes. SA-11 Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> SA-11 What is the solution and how is it implemented?