[non-validated] Documented Security Design Reviews per NIST PW.2

Generated catalog draft. No operational assessment or human approval is claimed.

[non-validated] This question has unresolved selected work.

Question

[non-validated] Has the service provider conducted documented security design reviews verifying compliance with defined security requirements and risk treatment decisions during development, as required by NIST Practice PW.2 (C.3.2)?

Explanation

[non-validated] Has the service provider conducted documented security design reviews verifying compliance with defined security requirements and risk treatment decisions during development, as required by NIST Practice PW.2 (C.3.2)?

Criterion and evidence

Verification through documented security design review records showing alignment of architectural decisions with defined security requirements and explicit risk treatment decisions per NIST Secure Software Development Practice PW.2 (Appendix C.3.2). Acceptable alternatives demonstrate equivalent systematic verification methodology with explicit mapping to risk inputs. Absence of development-phase artifacts leaves assessment pending.

AI assistance prompt

Replace this placeholder with one clear yes/no condition within the scope of Secure Development Lifecycle and Risk Management. Define the evidence rule and keep the question within 512 characters. Do not invent an assessment outcome.

Clarifications

What evidence satisfies the design review requirement?

Documented records (e.g., design review minutes, traceability matrices, signed design documents) dated during the development phase, demonstrating verification of architectural decisions against defined security requirements and explicit risk treatment plans, with explicit reference to NIST Practice PW.2 (Appendix C.3.2).

When is the assessment pending?

Pending if no development-phase security design documentation is provided, if verification lacks risk linkage, if assertions are unsupported by artifacts, or if proposed but unexecuted procedures are substituted for actual reviews. Meeting notes without documented verification or unverified compliance statements do not satisfy the criterion.

References

NIST Secure Software Development Practices

https://pages.nist.gov/nccoe-devsecops/ (opens in a new tab)