Test and Development Zone D Security Technical Implementation Guide

Version: 1

Updated: 19 Apr 2022

Findings: 22

Findings

V-39344 - Network infrastructure and systems supporting the test and development environment must be documented within the organizations accreditation package. (medium)
V-39345 - Network infrastructure and systems supporting the test and development environment must follow DoD certification and accreditation procedures before connecting to a DoD operational network or Internet Service Provider. (medium)
V-39433 - Network infrastructure and systems supporting the test and development environment must be registered in a DoD asset management system. (medium)
V-39434 - Network infrastructure and systems supporting the test and development environment must be managed from a management network. (medium)
V-39435 - The organization must document impersistent connections to the test and development environment with approval by the organizations Authorizing Official. (medium)
V-39437 - Development systems must have antivirus installed and enabled with up-to-date signatures. (high)
V-39438 - Development systems must have HIDS or HIPS installed and configured with up-to-date signatures. (medium)
V-39439 - Development systems must have a firewall installed, configured, and enabled. (medium)
V-39440 - Development systems must be part of a patch management solution and all systems must be up to date. (high)
V-39441 - A change management policy must be implemented for application development. (medium)
V-39611 - The organization must document and gain approval from the Change Control Authority prior to migrating data to DoD operational networks. (medium)
V-39614 - Application code must go through a code review prior to deployment into DoD operational networks. (medium)
V-39619 - Access to source code during application development must be restricted to authorized users. (medium)
V-39621 - The organization must sanitize data transferred to test and development environments from DoD operational networks for testing to remove personal and sensitive information exempt from the Freedom of Information Act. (medium)
V-39659 - The Zone D test and development environment must be physically separate and isolated from any DoD operational network. (high)
V-39660 - The test and development environment must not have access to DoD operational networks. (medium)
V-39669 - Remote access VPNs must prohibit the use of split tunneling on VPN connections. (medium)
V-39670 - Remote access into the test and development environment must originate from a non-DoD operational network segment. (medium)
V-39672 - Virtual machines used for application development and testing must not share the same physical host with DoD operational virtual machines. (medium)
V-39674 - The organization must have a current ISP GIG Waiver for any ISP connections to the test and development environment. (low)
V-41494 - Data used for testing and development must be downloaded through a secure connection to an IA-compliant system for vulnerability scanning prior to deployment in the test and development environment. (medium)
V-43317 - The organization must create a policy and procedures document for proper handling and transport of data entering (physically or electronically) the test and development environment. (medium)