SFS 8 / SF 1

Back to SFS 8

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

For new software systems developed during the review period, has the organization maintained documented and approved evidence showing how all security risks identified through threat analysis were addressed?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented approved plans exist for handling all identified security risks

Assessment criterion and evidence

Actor: Organization. Scope: New software development lifecycle. Evidence period: Review period. Required evidence: Records showing approved handling plans linked to threat analysis outputs. Negative criterion: Missing plans for one or more identified security risks. Missing evidence: Pending assessment due to unavailable documentation

View the JSON record (opens in a new tab).

Assessment result: unset.