At least one tester must be designated to test for security flaws in addition to functional testing.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-222646 | APSC-DV-003150 | SV-222646r961863_rule | CCI-003182 | medium |
| Description | ||||
| If there is no person designated to test for security flaws, vulnerabilities can potentially be missed during testing. This requirement is meant to apply to developers or organizations that are doing development work. | ||||
| STIG | Date | |||
| Application Security and Development Security Technical Implementation Guide | 2025-02-12 | |||
Related Frameworks
2 paths across 2 frameworks
Related Frameworks
NIST 800-531 mapping
SA-11(2)
1.00
- DISA · 6 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI1 mapping
CCI-003182
1.00
- DISA · 6 · disa_xccdf · related
Details
Check Text (C-222646r961863_chk)
Review the organization chart and interview the admin staff.
Identify personnel designated as application security testers.
If the organization operating the application is not doing development work, this requirement is not applicable.
If the organization has not designated personnel to conduct security testing, this is a finding.
Fix Text (F-24305r493847_fix)
Designate personnel to conduct security testing on the applications.