id: "SA-03(01)" title: "Manage Preproduction Environment" family: "SA" family_name: "System and Services Acquisition" sort_id: "sa-03.01" priority: "P1" implementation_level: "organization" parent: "SA-03" enhancement: True
Statement
Protect system preproduction environments commensurate with risk throughout the system development life cycle for the system, system component, or system service.
Guidance
The preproduction environment includes development, test, and integration environments. The program protection planning processes established by the Department of Defense are examples of managing the preproduction environment for defense contractors. Criticality analysis and the application of controls on developers also contribute to a more secure system development environment.
Assessment Objective
system pre-production environments are protected commensurate with risk throughout the system development life cycle for the system, system component, or system service.
System and services acquisition policy
procedures addressing the integration of security and supply chain risk management into the system development life cycle process
system development life cycle documentation
procedures addressing program protection planning
criticality analysis results
security and supply chain risk management strategy/program documentation
system security plan
supply chain risk management plan
other relevant documents or records
Organizational personnel with security and system life cycle development responsibilities
organizational personnel with information security responsibilities
Organizational processes for defining and documenting the system development life cycle
organizational processes for identifying system development life cycle roles and responsibilities
organizational process for integrating security risk management into the system development life cycle
mechanisms supporting and/or implementing the system development life cycle