SFS 8 / SF A

Back to SFS 8

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Has documented evidence been maintained throughout the review period showing that security requirements were updated to address newly identified threats or changes in the threat landscape during software development lifecycle phases?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented requirement updates linked to verified threat assessments

Assessment criterion and evidence

Actor: Development teams maintaining security requirements. Scope: All new software systems developed during the review period. Evidence period: Throughout the review period. Required evidence: Version-controlled security requirements with update timestamps; Threat assessment reports showing newly identified risks. Negative criterion: No evidence of requirement modifications despite known threat changes. Missing evidence: Pending until requirement-traceability documentation is provided

View the JSON record (opens in a new tab).

Assessment result: unset.