Test and Development Zone D Security Technical Implementation Guide

The Test and Development Zone D Security Technical Implementation Guide (V1 R6) has 22 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

22STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R6

CurrentPublished Wed Apr 27 2022

Access to source code during application development must be restricted to authorized users.

Test and Development Zone D Security Technical Implementation Guide

Assessment Title

Rule Text

Access to source code during application development must be restricted to authorized users.

Description

Discussion Text

Restricting access to source code and the application to authorized users will limit the risk of source code theft or other potential compromise.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-39619

Rule

SV-51477r1_rule

Severity

medium

Rule Version

ENTD0140

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Review the organization's site security plan and documentation to determine whether there is a list of current authorized users.  If a current list of authorized users is missing from the site security plan for the test and development environment, this is a finding.

If there isn't any application development occurring in the zone environment, this requirement is not applicable.

Implementation Procedure

Fix Text

Document all authorized users with access to the development environment and access to source code.   If the documentation exists but is not current, bring the documentation up to date.

STIG check 13 of 22 in the Test and Development Zone D STIG checklist

← Previous · V-39614Application code must go through a code review prior to deployment into DoD operational networks.Next · V-39621 →The organization must sanitize data transferred to test and development environments from DoD operational networks for testing to remove personal and sensitive information exempt from the Freedom of Information Act.