SFS 9 / SF 2

Back to SFS 9

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Has documented evidence confirmed that each in-scope application's current production version and all externally facing components underwent security auditing during the review period, with all critical audit findings remediated and retested?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: documented evidence confirms security auditing covered specified scope with critical findings remediated and retested

Assessment criterion and evidence

Actor: the organization. Scope: each in-scope application's current production version and externally facing components. Evidence period: the review period. Required evidence: Security audit report specifying tested version and components; Remediation records for critical findings; Retest results confirming fixes. Negative criterion: no evidence, incomplete scope coverage, or critical findings unremediated. Missing evidence: pending until documented evidence is provided

View the JSON record (opens in a new tab).

Assessment result: unset.