Skip to main content

💼 SA-11 Developer Testing and Evaluation (M)(H)

  • Contextual name: 💼 SA-11 Developer Testing and Evaluation (M)(H)
  • ID: /frameworks/fedramp-moderate-security-controls/sa/11
  • Located in: 💼 System and Services Acquisition

Description​

Require the developer of the system, system component, or system service, at all post-design stages of the system development life cycle, to:

a. Develop and implement a plan for ongoing security and privacy assessments;

b. Perform [Selection (one-or-more): unit; integration; system; regression] testing/evaluation [Assignment: organization-defined frequency] at [Assignment: organization-defined depth and coverage];

c. Produce evidence of the execution of the assessment plan and the results of the testing and evaluation;

d. Implement a verifiable flaw remediation process; and

e. Correct flaws identified during testing and evaluation.

Similar​

  • Sections
    • /frameworks/fedramp-high-security-controls/sa/11
  • Internal
    • ID: dec-c-03393ba2

Similar Sections (Take Policies From)​

SectionSub SectionsInternal RulesPoliciesFlags
💼 FedRAMP High Security Controls → 💼 SA-11 Developer Testing and Evaluation (M)(H)2

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 SA-11(1) Static Code Analysis (M)(H)
💼 SA-11(2) Threat Modeling and Vulnerability Analyses (M)(H)