SA-15(4): Threat Modeling / Vulnerability Analysis

Control Family:

System And Services Acquisition

Parent Control:

SA-15: Development Process, Standards, And Tools

Priority:

P2: Implement P2 security controls after implementation of P1 controls.

CSF v1.1 References:

ID.SC-2
PR.IP-2

Threats Addressed:

Information Disclosure

Baselines:

(Not part of any baseline)

Control is withdrawn in the next version of this control set and incorporated into: SA-11(2): Threat Modeling and Vulnerability Analyses.

Control Statement

The organization requires that developers perform threat modeling and a vulnerability analysis for the information system at [Assignment: organization-defined breadth/depth] that:

Uses [Assignment: organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels];
Employs [Assignment: organization-defined tools and methods]; and
Produces evidence that meets [Assignment: organization-defined acceptance criteria].