SA-11.3: Independent Verification of Assessment Plans and Evidence

An OSCAL Control

Statement

(a)
Require an independent agent satisfying to verify the correct implementation of the developer security and privacy assessment plans and the evidence produced during testing and evaluation; and
(b)
Verify that the independent agent is provided with sufficient information to complete the verification process or granted the authority to obtain such information.

- independence criteria
  independence criteria to be satisfied by an independent agent are defined;