STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

The changes to the application must be assessed for IA and accreditation impact prior to implementation.

DISA Rule

SV-222651r508029_rule

Vulnerability Number

V-222651

Group Title

SRG-APP-000516

Rule Version

APSC-DV-003200

Severity

CAT II

CCI(s)

• CCI-003173 - The organization requires the developer of the information system, system component, or information system service to perform unit, integration, system, and/or regression testing/evaluation at an organization-defined depth and coverage.
• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Review IA impact to the system prior to implementing changes.

Check Contents

Interview the application and system administrators and determine if changes to the application are assessed for IA impact prior to implementation.

Review the CCB process documentation to ensure potential changes to the application are evaluated to determine impact. An informal group may be tasked with impact assessment of upcoming version changes.

If IA impact analysis is not performed, this is a finding.

Vulnerability Number

V-222651

Documentable

False

Rule Version

APSC-DV-003200

Severity Override Guidance

Interview the application and system administrators and determine if changes to the application are assessed for IA impact prior to implementation.

Review the CCB process documentation to ensure potential changes to the application are evaluated to determine impact. An informal group may be tasked with impact assessment of upcoming version changes.

If IA impact analysis is not performed, this is a finding.

Check Content Reference

M

Target Key

4093

Comments