SA-11(3) Independent Verification of Assessment Plans and Evidence
Control enhancement of SA-11 Developer Testing and Evaluation
Control
Require an independent agent satisfying [Assignment: independence criteria] to verify the correct implementation of the developer security and privacy assessment plans and the evidence produced during testing and evaluation; and
Verify that the independent agent is provided with sufficient information to complete the verification process or granted the authority to obtain such information.
Discussion
Independent agents have the qualifications—including the expertise, skills, training, certifications, and experience—to verify the correct implementation of developer security and privacy assessment plans.
Related controls
Need SA-11(3) implemented and evidenced?
We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.
Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.