Skip to content
ATO Pathways
  Log In

SA-11.1: Static Code Analysis

An OSCAL Control

Statement

    • Require the developer of the system, system component, or system service to employ static code analysis tools to identify common flaws and document the results of the analysis.

        • Requirement:

          The service provider must document its methodology for reviewing newly developed code for the Service in its Continuous Monitoring Plan.

          If Static code analysis cannot be performed (for example, when the source code is not available), then dynamic code analysis must be performed (see SA-11 (8))