BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

APSC-DV-003150 At least one tester must be designated to test for security flaws in addition to functional testing.

DISA STIG library V6R5
All changes in this version
first version loaded CAT II

Maps to SA-11(2) via CCI-003182

Title

At least one tester must be designated to test for security flaws in addition to functional testing.

Control

Review the organization chart and interview the admin staff. Identify personnel designated as application security testers. If the organization operating the application is not doing development work, this requirement is not applicable. If the organization has not designated personnel to conduct security testing, this is a finding.

Discussion

If there is no person designated to test for security flaws, vulnerabilities can potentially be missed during testing. This requirement is meant to apply to developers or organizations that are doing development work.

Related controls

CCI-003182

Fix

Designate personnel to conduct security testing on the applications.