BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

APSC-DV-003200 The changes to the application must be assessed for IA and accreditation impact prior to implementation.

DISA STIG library V6R5
All changes in this version
first version loaded CAT II

Maps to SA-11 via CCI-003173

Title

The changes to the application must be assessed for IA and accreditation impact prior to implementation.

Control

Interview the application and system administrators and determine if changes to the application are assessed for IA impact prior to implementation. Review the CCB process documentation to ensure potential changes to the application are evaluated to determine impact. An informal group may be tasked with impact assessment of upcoming version changes. If IA impact analysis is not performed, this is a finding.

Discussion

When changes are made to an application, either in the code or in the configuration of underlying components such as the OS or the web or application server, there is the potential for security vulnerabilities to be opened up on the system. IA assessment of proposed changes is necessary to verify security integrity is maintained within the application.

Related controls

CCI-003173

Fix

Review IA impact to the system prior to implementing changes.