---

id: "SA-11(02)" title: "Threat Modeling and Vulnerability Analyses" family: "SA" family_name: "System and Services Acquisition" sort_id: "sa-11.02" priority: "P1" implementation_level: "organization" parent: "SA-11" enhancement: True

---

Statement

Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analyses during development and the subsequent testing and evaluation of the system, component, or service that:

Uses the following contextual information: {{ insert: param, sa-11.02_odp.01 }};

Employs the following tools and methods: {{ insert: param, sa-11.02_odp.02 }};

Conducts the modeling and analyses at the following level of rigor: {{ insert: param, sa-11.2_prm_3 }} ; and

Produces evidence that meets the following acceptance criteria: {{ insert: param, sa-11.2_prm_4 }}.

Guidance

Systems, system components, and system services may deviate significantly from the functional and design specifications created during the requirements and design stages of the system development life cycle. Therefore, updates to threat modeling and vulnerability analyses of those systems, system components, and system services during development and prior to delivery are critical to the effective operation of those systems, components, and services. Threat modeling and vulnerability analyses at this stage of the system development life cycle ensure that design and implementation changes have been accounted for and that vulnerabilities created because of those changes have been reviewed and mitigated.

Assessment Objective: the developer of the system, system component, or system service is required to perform threat modeling during development of the system, component, or service that uses {{ insert: param, sa-11.02_odp.01 }};

Assessment Objective: the developer of the system, system component, or system service is required to perform vulnerability analyses during development of the system, component, or service that uses {{ insert: param, sa-11.02_odp.01 }};

Assessment Objective: the developer of the system, system component, or system service is required to perform threat modeling during the subsequent testing and evaluation of the system, component, or service that uses {{ insert: param, sa-11.02_odp.01 }};

Assessment Objective: the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that uses {{ insert: param, sa-11.02_odp.01 }};

Assessment Objective: the developer of the system, system component, or system service is required to perform threat modeling during development of the system, component, or service that employs {{ insert: param, sa-11.02_odp.02 }};

Assessment Objective: the developer of the system, system component, or system service is required to perform threat modeling during the subsequent testing and evaluation of the system, component, or service that employs {{ insert: param, sa-11.02_odp.02 }};

Assessment Objective: the developer of the system, system component, or system service is required to perform vulnerability analyses during development of the system, component, or service that employs {{ insert: param, sa-11.02_odp.02 }};

Assessment Objective: the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that employs {{ insert: param, sa-11.02_odp.02 }};

Assessment Objective: the developer of the system, system component, or system service is required to perform threat modeling at {{ insert: param, sa-11.02_odp.03 }} during development of the system, component, or service;

Assessment Objective: the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that conducts modeling and analyses at {{ insert: param, sa-11.02_odp.04 }};

Assessment Objective: the developer of the system, system component, or system service is required to perform threat modeling during development of the system, component, or service that produces evidence that meets {{ insert: param, sa-11.02_odp.05 }};

Assessment Objective: the developer of the system, system component, or system service is required to perform threat modeling during the subsequent testing and evaluation of the system, component, or service that produces evidence that meets {{ insert: param, sa-11.02_odp.05 }};

Assessment Objective: the developer of the system, system component, or system service is required to perform vulnerability analyses during development of the system, component, or service that produces evidence that meets {{ insert: param, sa-11.02_odp.06 }};

Assessment Objective: the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that produces evidence that meets {{ insert: param, sa-11.02_odp.06 }}.

System and services acquisition policy

procedures addressing system developer security testing

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system developer security test plans

records of developer security testing results for the system, system component, or system service

vulnerability scanning results

system risk assessment reports

threat and vulnerability analysis reports

system security plan

supply chain risk management plan

other relevant documents or records

Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with developer security testing responsibilities

system developers

organizational personnel with supply chain risk management responsibilities

Organizational processes for monitoring developer security testing and evaluation

mechanisms supporting and/or implementing the monitoring of developer security testing and evaluation