SA-3(2)—System Development Life Cycle | Use of Live or Operational Data

IL5

IL6

>Control Description

(a) Approve, document, and control the use of live data in preproduction environments for the system, system component, or system service; and (b) Protect preproduction environments for the system, system component, or system service at the same impact or classification level as any live data in use within the preproduction environments.

>DoD Impact Level Requirements

No specific parameter values or requirements for this impact level.

>Discussion

Live data is also referred to as operational data. The use of live or operational data in preproduction (i.e., development, test, and integration) environments can result in significant risks to organizations. In addition, the use of personally identifiable information in testing, research, and training increases the risk of unauthorized disclosure or misuse of such information.

Therefore, it is important for the organization to manage any additional risks that may result from the use of live or operational data. Organizations can minimize such risks by using test or dummy data during the design, development, and testing of systems, system components, and system services. Risk assessment techniques may be used to determine if the risk of using live or operational data is acceptable.

>Related Controls

PM-25

RA-3

>Assessment Interview Topics

Questions assessors commonly ask

Process & Governance:

•What acquisition policies and procedures address the requirements of SA-3(2)?
•How are security and privacy requirements integrated into the acquisition process?
•Who is responsible for ensuring that acquisitions comply with SA-3(2)?
•How is security integrated throughout your system development lifecycle (SDLC)?

Technical Implementation:

•How are security requirements defined and documented in acquisition contracts?
•What mechanisms ensure that acquired systems and services meet security requirements?
•How do you validate that vendors and service providers comply with specified security controls?
•What security practices are required at each phase of the SDLC?

Evidence & Documentation:

•Can you provide examples of acquisition documentation that includes security requirements?
•What evidence demonstrates that acquired systems meet security specifications?
•Where is acquisition security documentation maintained throughout the system lifecycle?
•Can you show evidence of security activities performed during development?

Ask AI

Configure your API key to use AI features.