SFS 9 / SF E

Back to SFS 9

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Has documented evidence confirmed that security audits for in-scope applications included testing for common input validation vulnerabilities such as SQL injection and cross-site scripting throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented audit reports include test cases for SQL injection and cross-site scripting vulnerabilities

Assessment criterion and evidence

Actor: organization. Scope: in-scope applications. Evidence period: throughout the review period. Required evidence: Security audit reports demonstrating test cases for SQL injection and cross-site scripting. Negative criterion: Audit reports lack evidence of testing for specified input validation vulnerabilities. Missing evidence: pending

View the JSON record (opens in a new tab).

Assessment result: unset.