CyberStrikeus/CyberStrike - Page 134

sa-12-1-acquisition-strategies-tools-methods

Acquisition Strategies / Tools / Methods

sa-12-10-validate-as-genuine-and-not-altered

Validate as Genuine and Not Altered

sa-12-12-inter-organizational-agreements

Inter-organizational Agreements

sa-12-13-critical-information-system-components

Critical Information System Components

sa-12-14-identity-and-traceability

Identity and Traceability

sa-12-15-processes-to-address-weaknesses-or-deficiencies

Processes to Address Weaknesses or Deficiencies

sa-12-2-supplier-reviews

Supplier Reviews

sa-12-3-trusted-shipping-and-warehousing

Trusted Shipping and Warehousing

sa-12-4-diversity-of-suppliers

Diversity of Suppliers

sa-12-5-limitation-of-harm

Limitation of Harm

sa-12-6-minimizing-procurement-time

Minimizing Procurement Time

sa-12-7-assessments-prior-to-selection-acceptance-update

Assessments Prior to Selection / Acceptance / Update

sa-12-8-use-of-all-source-intelligence

Use of All-source Intelligence

sa-12-9-operations-security

Operations Security

sa-12-supply-chain-protection

Supply Chain Protection

sa-13-trustworthiness

Trustworthiness

sa-14-1-critical-components-with-no-viable-alternative-sourcing

Critical Components with No Viable Alternative Sourcing

sa-14-criticality-analysis

Criticality Analysis

sa-15-1-quality-metrics

Require the developer of the system, system component, or system service to: Define quality metrics at the beginning of the development process; and P

sa-15-10-incident-response-plan

Require the developer of the system, system component, or system service to provide, implement, and test an incident response plan.

sa-15-11-archive-system-or-component

Require the developer of the system or system component to archive the system or component to be released or delivered together with the corresponding

sa-15-12-minimize-personally-identifiable-information

Require the developer of the system or system component to minimize the use of personally identifiable information in development and test environment

sa-15-13-logging-syntax

Require the developer of the system or system component to minimize the use of personally identifiable information in development and test environment

sa-15-2-security-and-privacy-tracking-tools

Require the developer of the system, system component, or system service to select and employ security and privacy tracking tools for use during the d

sa-15-3-criticality-analysis

Require the developer of the system, system component, or system service to perform a criticality analysis: At the following decision points in the sy

sa-15-4-threat-modeling-and-vulnerability-analysis

Threat Modeling and Vulnerability Analysis

sa-15-5-attack-surface-reduction

Require the developer of the system, system component, or system service to reduce attack surfaces to [organization-defined].

sa-15-6-continuous-improvement

Require the developer of the system, system component, or system service to implement an explicit process to continuously improve the development proc

sa-15-7-automated-vulnerability-analysis

Require the developer of the system, system component, or system service [organization-defined] to: Perform an automated vulnerability analysis using

sa-15-8-reuse-of-threat-and-vulnerability-information

Require the developer of the system, system component, or system service to use threat modeling and vulnerability analyses from similar systems, compo

sa-15-9-use-of-live-data

Use of Live Data

sa-15-development-process-standards-and-tools

Require the developer of the system, system component, or system service to follow a documented development process that: Explicitly addresses securit

sa-16-developer-provided-training

Require the developer of the system, system component, or system service to provide the following training on the correct use and operation of the imp

sa-17-1-formal-policy-model

Require the developer of the system, system component, or system service to: Produce, as an integral part of the development process, a formal policy

sa-17-2-security-relevant-components

Require the developer of the system, system component, or system service to: Define security-relevant hardware, software, and firmware; and Provide a

sa-17-3-formal-correspondence

Require the developer of the system, system component, or system service to: Produce, as an integral part of the development process, a formal top-lev

sa-17-4-informal-correspondence

Require the developer of the system, system component, or system service to: Produce, as an integral part of the development process, an informal desc

sa-17-5-conceptually-simple-design

Require the developer of the system, system component, or system service to: Design and structure the security-relevant hardware, software, and firmwa

sa-17-6-structure-for-testing

Require the developer of the system, system component, or system service to structure security-relevant hardware, software, and firmware to facilitate

sa-17-7-structure-for-least-privilege

Require the developer of the system, system component, or system service to structure security-relevant hardware, software, and firmware to facilitate