SFS 8 / SF 7

Back to SFS 8

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Has documented evidence been maintained for all new software systems during the review period demonstrating that security requirements were derived from threat analysis results and included in development specifications?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented evidence exists showing security requirements were derived from threat analysis and incorporated into development specifications

Assessment criterion and evidence

Actor: organization. Scope: new software systems. Evidence period: review period. Required evidence: Documented threat analysis reports linked to security requirement specifications. Negative criterion: No evidence demonstrates traceability from threat analysis to security requirements in specifications. Missing evidence: Pending assessment due to unavailable documentation

View the JSON record (opens in a new tab).

Assessment result: unset.