DISA Security Technical Implementation Guides (STIGs) DEV-1: Vendor STIG intent form, introductory meeting and DISA's decision point

What does DEV-1 require?

A vendor wishing to write a STIG submits the Vendor STIG Intent Form through the DOD Cyber Exchange; DISA validates it and decides whether the vendor enters Planning. Before the introductory meeting the vendor provides marketing material, product website addresses, product usage in the DOD, its meeting participants and time zone; the meeting is a fifteen-minute DISA introduction to the process and requirements and a fifteen-minute vendor presentation covering a demonstration or explanation of the product, its main accessible and configurable functional areas and those tested or approved under a NIAP Protection Profile, the justification for the STIG and the product's current DOD use cases and density, attended by a technical team able to answer questions about securing the product to DOD standards rather than by sales representatives. DISA then determines the level of need and notifies the vendor by email whether it proceeds to Development.