SFS 9 / SF 5

Back to SFS 9

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Has documented evidence confirmed that security audit methodologies for all in-scope applications complied with recognized industry standards during the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented alignment between audit methodologies and current industry standards (e.g., OWASP ASVS, NIST SP 800-115)

Assessment criterion and evidence

Actor: organization. Scope: all in-scope applications undergoing security auditing. Evidence period: current review period. Required evidence: Audit plan specifying methodology standards; Evidence showing methodology application during testing period. Negative criterion: Absence of methodology documentation or evidence of non-compliant/custom methodologies. Missing evidence: Pending verification when methodology documentation is unavailable

View the JSON record (opens in a new tab).

Assessment result: unset.