💼 SA-11(2) Threat Modeling and Vulnerability Analyses (M)(H)
- Contextual name: 💼 SA-11(2) Threat Modeling and Vulnerability Analyses (M)(H)
- ID:
/frameworks/fedramp-high-security-controls/sa/11/02 - Located in: 💼 SA-11 Developer Testing and Evaluation (M)(H)
Description
Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analyses during development and the subsequent testing and evaluation of the system, component, or service that:
(a) Uses the following contextual information: [Assignment: organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels];
(b) Employs the following tools and methods: [Assignment: organization-defined tools and methods];
(c) Conducts the modeling and analyses at the following level of rigor: [Assignment: organization-defined breadth and depth of modeling and analyses]; and
(d) Produces evidence that meets the following acceptance criteria: [Assignment: organization-defined acceptance criteria].
Similar
- Sections
/frameworks/nist-sp-800-53-r5/sa/11/02
- Internal
- ID:
dec-c-9126ae91
- ID:
Similar Sections (Take Policies From)
| Section | Sub Sections | Internal Rules | Policies | Flags |
|---|---|---|---|---|
| 💼 NIST SP 800-53 Revision 5 → 💼 SA-11(2) Developer Testing and Evaluation _ Threat Modeling and Vulnerability Analyses |
Similar Sections (Give Policies To)
| Section | Sub Sections | Internal Rules | Policies | Flags |
|---|---|---|---|---|
| 💼 FedRAMP Moderate Security Controls → 💼 SA-11(2) Threat Modeling and Vulnerability Analyses (M)(H) |
Sub Sections
| Section | Sub Sections | Internal Rules | Policies | Flags |
|---|