SA-17(1)
System and Services Acquisition
enhancement
Formal Policy Model
Parent: SA-17
Description
Require the developer of the system, system component, or system service to: a. Produce, as an integral part of the development process, a formal policy model describing the [organization-defined parameter] to be enforced; and b. Prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security and privacy policy when implemented.
Mapped SPARTA techniques
No techniques mapped to this control.
Cite as SafeMode Space, nist-80053-rev5 SA-17(1).