[Module Name] Security Plan Formal Review Report

Note

Document header

[Module Name] Security Plan Formal Review		status: draft security: YES safety: ASIL_B
tags: template version: 1 realizes: wp__fdr_reports_security
doc__mod_temp_module_name_security_plan_fdr		Generic Document

Attention

The above directive must be updated according to your Module.

• Modify Your Module Name to be your Module Name

• Modify id to be your Module Name in lower snake case preceded by doc__ and followed by _security_plan_fdr

• Adjust status to be valid

• Adjust safety and tags according to your needs

1. Purpose

The purpose of this review checklist is to provide a guidence for reviewing the Security Plans for each module. Each Module Security Plan shall have one checklist filled.

2. Conduct

As described in wf__p_formal_security_rv, the formal document review is performed by an “external” security auditor, supported by the Security Manager:

• reviewer: <committer with security manager/auditor skills explicitly named here>

Note

wf__p_formal_security_rv is currently marked as “tailored out (needs discussion)” at process level. Confirm with the Security Manager whether a formal review is actually performed for this Module before relying on this checklist.

3. Checklist

See also the review concept for further information about reviews in general and inspection in particular.

Table 21 Security Plan Checklist

Id	Security Plan activity	Compliant to ISO SAE 21434?	Reference	Comment
1	Is the rationale for the Security Work Products tailoring included?	[YES | NO ]	std_req__isosae21434__prj_management_6431 std_req__isosae21434__prj_management_6432	<Rationale for result>
2	Is impact analysis planned in case of re-use of SW (needed for every release following the first formal release)?	[YES | NO ]	std_req__isosae21434__prj_management_6441 std_req__isosae21434__prj_management_6442 std_req__isosae21434__prj_management_6443	<Rationale for result>
3	Does the Security Plan define all needed activities for security management (including formal document review and security audit/assessment)?	[YES | NO ]	std_req__isosae21434__prj_management_6411 std_wp__isosae21434__org_management_555	Security audit and assessment have no dedicated std_req modeled in the process description, only the related work products/workflows (wf__p_fs_audit_security, wf__p_formal_security_rv).
4	Does the Security Plan define all needed activities for SW development, integration and verification?	[YES | NO ]	std_req__isosae21434__prj_management_6421	<Rationale for result>
5	Does the Security Plan define all needed activities for security analysis (TARA)?	[YES | NO ]	std_req__isosae21434__prj_management_6421	<Rationale for result>
6	Does the Security Plan define all needed activities for supporting processes (incl. tool mgt, configuration and change management)?	[YES | NO ]	std_req__isosae21434__prj_management_6421	<Rationale for result>
7	Does the Security Plan document a responsible for all activities?	[YES | NO ]	std_req__isosae21434__prj_management_6411	<Rationale for result>
8	If OTS/OSS software components are used, is it planned to be qualified (e.g. maintenance status, CVE history, sufficiency of existing documentation)?	[YES | NO ]	std_req__isosae21434__prj_management_6461 std_req__isosae21434__prj_management_6462	<Rationale for result>
9	Is a Security Manager and a Project Lead appointed for the project?	[YES | NO ]	std_req__isosae21434__prj_management_6411	<Rationale for result>
10	Is Security Plan sufficiently linked to the Project Plan?	[YES | NO ]	std_req__isosae21434__prj_management_6421	<Rationale for result>
11	Is Security Plan updated iteratively to show the progress?	[YES | NO ]	std_req__isosae21434__prj_management_6421	<Rationale for result>
12	If Out-of-context software components is used, are the assumptions documented?	[YES | NO ]	std_req__isosae21434__prj_management_6451 std_req__isosae21434__prj_management_6452 std_req__isosae21434__prj_management_6453	<Rationale for result>
13	Does the Security Plan define all needed activities for SBOM generation?	[YES | NO ]	std_req__isosae21434__prj_management_6461	<Rationale for result>
14	Does the Security Plan define regular vulnerability scans for the generated SBOM?	[YES | NO ]	std_req__isosae21434__continual_8521 std_req__isosae21434__continual_8621	<Rationale for result>

Note

Off-the-shelf means existing software which may used without modification, e.g. existing OSS