Important Notice: Our web hosting provider recently started charging us for additional visits, which was unexpected. In response, we're seeking donations. Depending on the situation, we may explore different monetization options for our Community and Expert Contributors. It's crucial to provide more returns for their expertise and offer more Expert Validated Answers or AI Validated Answers. Learn more about our hosting issue here.

Do SABI/TSABI approved COTS IA/IA-enabled IT products qualify as “validated” under NSTISSP #11?

April 26, 2017Approved COTS IA ia-enabled nstissp products qualify sabi validated

0

Posted

Do SABI/TSABI approved COTS IA/IA-enabled IT products qualify as “validated” under NSTISSP #11?

1 Answer

0

Posted

Generally not. However, much of the information that is created in the context of preparing a product for use in a SABI/TSABI environment will contribute greatly to a NIAP COTS testing activity and vice versa. As noted in Policy Information and Guidance Question 15, if the COTS product has already been procured and fielded, it need not retroactively go through a NIAP testing activity. However, if a COTS IA/IA-enabled IT product resides on the SABI/TSABI list and is being purchased after July 1, 2002, it is subject to NSTISSP #11 COTS IA testing.