id: "SA-15(08)" title: "Reuse of Threat and Vulnerability Information" family: "SA" family_name: "System and Services Acquisition" sort_id: "sa-15.08" priority: "P1" implementation_level: "organization" parent: "SA-15" enhancement: True
Statement
Require the developer of the system, system component, or system service to use threat modeling and vulnerability analyses from similar systems, components, or services to inform the current development process.
Guidance
Analysis of vulnerabilities found in similar software applications can inform potential design and implementation issues for systems under development. Similar systems or system components may exist within developer organizations. Vulnerability information is available from a variety of public and private sector sources, including the NIST National Vulnerability Database.
Assessment Objective: the developer of the system, system component, or system service is required to use threat modeling from similar systems, components, or services to inform the current development process;
Assessment Objective: the developer of the system, system component, or system service is required to use vulnerability analyses from similar systems, components, or services to inform the current development process.
System and services acquisition policy
supply chain risk management plan
procedures addressing development process, standards, and tools
solicitation documentation
acquisition documentation
service level agreements
acquisition contracts for the system, system component, or system service
threat modeling and vulnerability analyses from similar systems, system components, or system services
system security plan
other relevant documents or records
Organizational personnel with system and service acquisition responsibilities
organizational personnel with information security responsibilities
system developer
organizational personnel with supply chain risk management responsibilities