SFS 8 / SF E

Back to SFS 8

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are security risk treatment decisions periodically reviewed and updated to address new threats or development process changes throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented evidence of periodic reviews (e.g., quarterly) of security risk treatment decisions with updates reflecting new threats or development process changes

Assessment criterion and evidence

Actor: the organization. Scope: all new software development projects. Evidence period: throughout the review period. Required evidence: Documented review meeting minutes or records showing periodic assessment of risk treatment decisions; Evidence of updates to risk treatment plans based on review outcomes. Negative criterion: Absence of documented review records or outdated risk treatment decisions not addressing known threats. Missing evidence: Pending until documented review records for the review period are provided

View the JSON record (opens in a new tab).

Assessment result: unset.