Page 227

Secure configuration, installation, and operation of the system, component, or service. a. Effective use and maintenance of security and privacy functions/mechanisms. b. Known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions. c. User-accessible security and privacy functions/mechanisms and how to effectively use those functions/mechanisms. d. Methods for user interaction, which enable individuals to use the system, component, or service in a more secure manner and protect individual privacy. e. End user responsibilities to maintain the security and privacy of the system. f. The following shall also be done: Ensure each new or updated system includes supporting system documentation and technical specifications of information technology hardware, whether the system is developed or updated by in-house staff or by a third-party vendor. a. Create, manage, and secure system documentation libraries or data stores that are always available to only authorized personnel. b. Ensure that system documentation is readily available to support the staff responsible for operating, securing, and maintaining new and updated systems. c. Control system documentation to ensure that it is current and available for purposes such as auditing, troubleshooting, and staff turnover. d. All documentation of operational procedures must be approved by management and reviewed at least annually for accuracy and relevancy. e. SA-8 SECURITY AND PRIVACY ENGINEERING PRINCIPLES Organizations shall apply information system security and privacy engineering principles in the specification, design, development, implementation, and modification of systems and their components. Security and privacy engineering principles shall be primarily applied to new development information systems or systems undergoing major upgrades. For legacy systems, agencies shall apply security engineering principles to system upgrades and modifications to the extent that it is technically configurable, given the current state of hardware, software, and firmware within those systems. Security and privacy engineering principles shall include the following: Developing layered protections. a. Establishing sound security and privacy policy, architecture, and controls as the foundation for design. b. Incorporating security and privacy requirements into the SDLC. c. Delineating physical and logical security boundaries. d. Ensuring that system developers are trained on how to build secure software. e. Tailoring security and privacy controls to meet organizational and operational needs. f. Performing threat modeling to identify use cases, threat agents, attack vectors, and attack patterns as well as compensating controls and design patterns needed to mitigate risk. g. System and Services Acquisition Policy GV-PO-P5 Effective Date: 01/31/2025 Date Approved: 01/15/2025 Version: 1 Page #: 5 of 12