SFS 9 / SF A

Back to SFS 9

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Has documented evidence confirmed that security audits for in-scope applications specified whether testing was conducted with full internal access or only external access, based on the access granted during the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Audit reports explicitly state the access level provided (full internal or external only) and corresponding testing procedures performed

Assessment criterion and evidence

Actor: Organization conducting security audits. Scope: Externally facing applications undergoing security auditing. Evidence period: Current review period. Required evidence: Security audit reports with access level and testing procedures section; Records showing access level granted to auditors. Negative criterion: Audit reports omit access level details or testing procedures, or apply procedures inconsistent with the access provided. Missing evidence: No audit documentation specifying access level and testing procedures exists for in-scope applications

View the JSON record (opens in a new tab).

Assessment result: unset.