id: "SA-17(09)" title: "Design Diversity" family: "SA" family_name: "System and Services Acquisition" sort_id: "sa-17.09" priority: "P1" implementation_level: "organization" parent: "SA-17" enhancement: True
Statement
Use different designs for {{ insert: param, sa-17.09_odp }} to satisfy a common set of requirements or to provide equivalent functionality.
Guidance
Design diversity is achieved by supplying the same requirements specification to multiple developers, each of whom is responsible for developing a variant of the system or system component that meets the requirements. Variants can be in software design, in hardware design, or in both hardware and a software design. Differences in the designs of the variants can result from developer experience (e.g., prior use of a design pattern), design style (e.g., when decomposing a required function into smaller tasks, determining what constitutes a separate task and how far to decompose tasks into sub-tasks), selection of libraries to incorporate into the variant, and the development environment (e.g., different design tools make some design patterns easier to visualize). Hardware design diversity includes making different decisions about what information to keep in analog form and what information to convert to digital form, transmitting the same information at different times, and introducing delays in sampling (temporal diversity). Design diversity is commonly used to support fault tolerance.
Assessment Objective
different designs are used for {{ insert: param, sa-17.09_odp }} to satisfy a common set of requirements or to provide equivalent functionality.
System and services acquisition policy
enterprise architecture policy
procedures addressing developer security architecture and design diversity for the system
solicitation documentation
acquisition documentation
service level agreements
acquisition contracts for the system, system component, or system service
system design documentation
system security architecture documentation
system configuration settings and associated documentation
developer documentation describing design diversity
system security plan
other relevant documents or records
Organizational personnel with system and service acquisition responsibilities
organizational personnel with information security responsibilities
system developer
organizational personnel with information security architecture responsibilities