Application Security and Development Security Technical Implementation Guide

The Application Security and Development Security Technical Implementation Guide (V6 R5) has 286 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

286STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V6 · R5

CurrentPublished Wed Sep 30 2026

At least one tester must be designated to test for security flaws in addition to functional testing.

Application Security and Development Security Technical Implementation Guide

Assessment Title

Rule Text

At least one tester must be designated to test for security flaws in addition to functional testing.

Description

Discussion Text

If there is no person designated to test for security flaws, vulnerabilities can potentially be missed during testing.

This requirement is meant to apply to developers or organizations that are doing development work.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-222646

Rule

SV-222646r961863_rule

Severity

medium

Rule Version

APSC-DV-003150

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Review the organization chart and interview the admin staff.

Identify personnel designated as application security testers.

If the organization operating the application is not doing development work, this requirement is not applicable.

If the organization has not designated personnel to conduct security testing, this is a finding.

Implementation Procedure

Fix Text

Designate personnel to conduct security testing on the applications.

STIG check 258 of 286 in the Application Security and Development STIG checklist

← Previous · V-222645Application files must be cryptographically hashed prior to deploying to DoW operational networks.Next · V-222647 →Test procedures must be created and at least annually executed to ensure system initialization, shutdown, and aborts are configured to verify the system remains in a secure state.