SA-15(10)

Requirement

Require the developer of the system, system component, or system service to provide, implement, and test an incident response plan.

Discussion

The incident response plan provided by developers may provide information not readily available to organizations and be incorporated into organizational incident response plans. Developer information may also be extremely helpful, such as when organizations respond to vulnerabilities in commercial off-the-shelf products.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and services acquisition policy; procedures addressing incident response, standards, and tools; solicitation documentation; acquisition documentation; service level agreements; acquisition contracts for the system, system components or services; acquisition documentation; solicitation documentation; service level agreements; developer incident response plan; system security plan; privacy plan; supply chain risk management plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with system and service acquisition responsibilities; organizational personnel with information security responsibilities; system developer; organizational personnel with supply chain risk management responsibilities].

ID	Assessment Objectives
SA-15(10)[01]	the developer of the system, system component, or system service is required to provide an incident response plan;
SA-15(10)[02]	the developer of the system, system component, or system service is required to implement an incident response plan;
SA-15(10)[03]	the developer of the system, system component, or system service is required to test an incident response plan.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!