Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The application development team must provide an application incident response plan.
Description
Discussion Text
An application incident response process is managed by the development team and should include a method for individuals to submit potential security vulnerabilities to the development or maintenance team.
The plan should dictate what is to be done with the reported vulnerabilities. Reported vulnerabilities must be tracked throughout the process to ensure they are triaged, corrected, and tested. The corresponding update is released to the user community and the user community is notified of the availability of the application update.
Without an established application incident management plan and process, discovered issues and vulnerabilities will go unreported. Vulnerabilities will not be triaged and managed, and there may be delays in corrective actions.
Information on how to submit bug and vulnerability reports must also be included in the application design document or configuration guide.
This requirement is meant to be applied when reviewing an application with the development team.
The plan should dictate what is to be done with the reported vulnerabilities. Reported vulnerabilities must be tracked throughout the process to ensure they are triaged, corrected, and tested. The corresponding update is released to the user community and the user community is notified of the availability of the application update.
Without an established application incident management plan and process, discovered issues and vulnerabilities will go unreported. Vulnerabilities will not be triaged and managed, and there may be delays in corrective actions.
Information on how to submit bug and vulnerability reports must also be included in the application design document or configuration guide.
This requirement is meant to be applied when reviewing an application with the development team.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.