Citation Audit

Citation: SA-4(2) ¶ 1 – Require the developer of the system, system component, or system service to provide design and implementation information for the controls that includes: [Selection (one or more): security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; [GovRAMP Assignment: at a minimum to include security-relevant external system interfaces; high-level design; low-level design; source code or network and data flow diagram; [organization-defined design/implementation information]] at [Assignment: organization-defined level of detail].

Control: CC ID 1080 – Establish, implement, and maintain a security controls definition document.