SFS 9 / SF B

Back to SFS 9

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Has documented evidence confirmed that security audits for in-scope applications included human verification of security issues identified by automated tools during the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documentation showing human validation steps for critical findings identified by automated tools

Assessment criterion and evidence

Actor: security audit teams. Scope: in-scope applications undergoing security audits. Evidence period: throughout the review period. Required evidence: Audit reports demonstrating human verification processes; Examples of security issues validated beyond automated scan results. Negative criterion: Reliance solely on automated tool outputs without human verification or analysis. Missing evidence: Pending until audit reports and validation records are provided

View the JSON record (opens in a new tab).

Assessment result: unset.