Development is performed on platforms that are not STIG compliant and/or within a non-STIG compliant infrastructure.

Part of Development is performed on non-STIG'd platforms.

Associated with IA controls: ECSC-1

Associated with: CCI-000379

SV-14919r2_rule Development is performed on platforms that are not STIG compliant and/or within a non-STIG compliant infrastructure.

Vulnerability discussion

In order to ensure a system or application will work efficiently and securely once deployed into a DoD production environment, development must occur on secure platforms. Otherwise, potentially misguided developers may inject code or incorrectly configure an application that could lead to denial of service once deployed into a production environment. In addition, a system or application must be able to run in a STIG compliant environment once fielded.

Check content

Interview the IAO to determine if a process and procedure is in place and documented that prohibits developing applications or software in a non-STIG compliant infrastructure or on non-STIG compliant platforms.

Fix text

The IAO will ensure Development is performed on STIG compliant systems within a STIG compliant infrastructure. Reference the Application Security and Development and Application Services STIGs.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.