id: "SA-15(02)" title: "Security and Privacy Tracking Tools" family: "SA" family_name: "System and Services Acquisition" sort_id: "sa-15.02" priority: "P1" implementation_level: "organization" parent: "SA-15" enhancement: True
Statement
Require the developer of the system, system component, or system service to select and employ security and privacy tracking tools for use during the development process.
Guidance
System development teams select and deploy security and privacy tracking tools, including vulnerability or work item tracking systems that facilitate assignment, sorting, filtering, and tracking of completed work items or tasks associated with development processes.
Assessment Objective: the developer of the system, system component, or system service is required to select and employ security tracking tools for use during the development process;
Assessment Objective: the developer of the system, system component, or system service is required to select and employ privacy tracking tools for use during the development process.
System and services acquisition policy
system and services acquisition procedures
procedures addressing development process, standards, and tools
procedures addressing the integration of security and privacy requirements into the acquisition process
solicitation documentation
acquisition documentation
service level agreements
acquisition contracts for the system, system component, or system service
documentation of the selection of security and privacy tracking tools
evidence of employing security and privacy tracking tools
system security plan
privacy plan
privacy impact assessment
privacy risk assessment documentation
other relevant documents or records
Organizational personnel with system and service acquisition responsibilities
organizational personnel with information security responsibilities
system developer
organizational personnel with privacy responsibilities