SFS 9: Software Security Auditing
Assess how software security reviews and tests are scoped, performed, documented, and followed through to verified findings.
Scope and boundaries
This set covers vulnerability assessment, penetration testing, black-box and white-box review, and security testing of applications and services. Questions should identify the tested version, system boundary, procedure, evidence period, and criterion for accepting a finding or remediation. Reports and retest results support individual judgments; the presence of an auditing tool alone does not demonstrate effectiveness. Development practices belong to SFS 8, delivery records to SFS 7, and live incident monitoring to SFS 6.
The sixteen questions
Each SF position is one question. Both positions run from 0 to F.
| SF | Question page | Authoring record |
|---|---|---|
| 0 | SF 0 | 0090 |
| 1 | SF 1 | 0091 |
| 2 | SF 2 | 0092 |
| 3 | SF 3 | 0093 |
| 4 | SF 4 | 0094 |
| 5 | SF 5 | 0095 |
| 6 | SF 6 | 0096 |
| 7 | SF 7 | 0097 |
| 8 | SF 8 | 0098 |
| 9 | SF 9 | 0099 |
| A | SF A | 009A |
| B | SF B | 009B |
| C | SF C | 009C |
| D | SF D | 009D |
| E | SF E | 009E |
| F | SF F | 009F |
From questions to a profile
Only reviewed, accepted 0/1 assessments can populate the sixteen-bit set profile. SF 0 is the most significant bit and SF F the least significant bit. The completed result uses four hexadecimal digits, including leading zeros. A catalog definition does not establish a completed assessment profile.
Read assessment and validation, then encoding. A set profile preserves individual answers; it is not a summed security score.