Application code must go through a code review prior to deployment into DoD operational networks.

From Test and Development Zone A Security Technical Implementation Guide

Part of ENTD0130 - Code review not completed prior to application deployment.

Associated with IA controls: ECSC-1, DCSQ-1, ECSD-2, ECSD-1

SV-51472r1_rule Application code must go through a code review prior to deployment into DoD operational networks.

Vulnerability discussion

Prior to release of the application receiving an IATO for deployment into a DoD operational network, the application will have a thorough code review. Along with the proper testing, the code review will specify flaws causing security, compatibility, or reliability concerns that may compromise the operational network.

Check content

Determine whether there is a policy in place for code review prior to applications being deployed into a DoD operational network. If a code review policy has not been established, this is a finding. If there isn't any application development occurring in the zone environment, this requirement is not applicable.

Fix text

Implement a code review policy for applications before deployment into DoD operational networks.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.