NIST SP 800-53 (controls) 5.2.0
| Ref | Title | Text | |
|---|---|---|---|
| SA-01 | Policy and Procedures | a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy that: (a) | |
| SA-02 | Allocation of Resources | a. Determine the high-level information security and privacy requirements for the system or system service in mission and business process planning; b. Determine, document, and allocate the resources required to protect the system or system | |
| SA-03 | System Development Life Cycle | a. Acquire, develop, and manage the system using [Assignment: system-development life cycle] that incorporates information security and privacy considerations; b. Define and document information security and privacy roles and responsibiliti | |
| SA-03(01) in SA-3 |
Manage Preproduction Environment | Protect system preproduction environments commensurate with risk throughout the system development life cycle for the system, system component, or system service. | |
| SA-03(02) in SA-3 |
Use of Live or Operational Data | (a) Approve, document, and control the use of live data in preproduction environments for the system, system component, or system service; and (b) Protect preproduction environments for the system, system component, or system service at the | |
| SA-03(03) in SA-3 |
Technology Refresh | Plan for and implement a technology refresh schedule for the system throughout the system development life cycle. | |
| SA-04 | Acquisition Process | Include the following requirements, descriptions, and criteria, explicitly or by reference, using [Selection (one or more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, syst | |
| SA-04(01) in SA-4 |
Functional Properties of Controls | Require the developer of the system, system component, or system service to provide a description of the functional properties of the controls to be implemented. | |
| SA-04(02) in SA-4 |
Design and Implementation Information for Controls | Require the developer of the system, system component, or system service to provide design and implementation information for the controls that includes: [Selection (one or more): security-relevant external system interfaces; high-level des | |
| SA-04(03) in SA-4 |
Development Methods, Techniques, and Practices | Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes: (a) [Assignment: systems engineering methods]; (b) [Selection (one or more): {{ insert | |
| SA-04(04) in SA-4 |
Assignment of Components to Systems withdrawn | ||
| SA-04(05) in SA-4 |
System, Component, and Service Configurations | Require the developer of the system, system component, or system service to: (a) Deliver the system, component, or service with [Assignment: security configurations] implemented; and (b) Use the configurations as the default for any subsequ | |
| SA-04(06) in SA-4 |
Use of Information Assurance Products | (a) Employ only government off-the-shelf or commercial off-the-shelf information assurance and information assurance-enabled information technology products that compose an NSA-approved solution to protect classified information when the ne | |
| SA-04(07) in SA-4 |
NIAP-approved Protection Profiles | (a) Limit the use of commercially provided information assurance and information assurance-enabled information technology products to those products that have been successfully evaluated against a National Information Assurance partnership | |
| SA-04(08) in SA-4 |
Continuous Monitoring Plan for Controls | Require the developer of the system, system component, or system service to produce a plan for continuous monitoring of control effectiveness that is consistent with the continuous monitoring program of the organization. | |
| SA-04(09) in SA-4 |
Functions, Ports, Protocols, and Services in Use | Require the developer of the system, system component, or system service to identify the functions, ports, protocols, and services intended for organizational use. | |
| SA-04(10) in SA-4 |
Use of Approved PIV Products | Employ only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational systems. | |
| SA-04(11) in SA-4 |
System of Records | Include [Assignment: Privacy Act requirements] in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mission or function. | |
| SA-04(12) in SA-4 |
Data Ownership | (a) Include organizational data ownership requirements in the acquisition contract; and (b) Require all data to be removed from the contractor’s system and returned to the organization within [Assignment: time frame]. | |
| SA-05 | System Documentation | a. Obtain or develop administrator documentation for the system, system component, or system service that describes: 1. Secure configuration, installation, and operation of the system, component, or service; 2. Effective use and maintenance | |
| SA-05(01) in SA-5 |
Functional Properties of Security Controls withdrawn | ||
| SA-05(02) in SA-5 |
Security-relevant External System Interfaces withdrawn | ||
| SA-05(03) in SA-5 |
High-level Design withdrawn | ||
| SA-05(04) in SA-5 |
Low-level Design withdrawn | ||
| SA-05(05) in SA-5 |
Source Code withdrawn | ||
| SA-06 | Software Usage Restrictions withdrawn | ||
| SA-07 | User-installed Software withdrawn | ||
| SA-08 | Security and Privacy Engineering Principles | Apply the following systems security and privacy engineering principles in the specification, design, development, implementation, and modification of the system and system components: [Assignment: organization-defined systems security and | |
| SA-08(01) in SA-8 |
Clear Abstractions | Implement the security design principle of clear abstractions. | |
| SA-08(02) in SA-8 |
Least Common Mechanism | Implement the security design principle of least common mechanism in [Assignment: systems or system components]. | |
| SA-08(03) in SA-8 |
Modularity and Layering | Implement the security design principles of modularity and layering in [Assignment: organization-defined systems or system components]. | |
| SA-08(04) in SA-8 |
Partially Ordered Dependencies | Implement the security design principle of partially ordered dependencies in [Assignment: systems or system components]. | |
| SA-08(05) in SA-8 |
Efficiently Mediated Access | Implement the security design principle of efficiently mediated access in [Assignment: systems or system components]. | |
| SA-08(06) in SA-8 |
Minimized Sharing | Implement the security design principle of minimized sharing in [Assignment: systems or system components]. | |
| SA-08(07) in SA-8 |
Reduced Complexity | Implement the security design principle of reduced complexity in [Assignment: systems or system components]. | |
| SA-08(08) in SA-8 |
Secure Evolvability | Implement the security design principle of secure evolvability in [Assignment: systems or system components]. | |
| SA-08(09) in SA-8 |
Trusted Components | Implement the security design principle of trusted components in [Assignment: systems or system components]. | |
| SA-08(10) in SA-8 |
Hierarchical Trust | Implement the security design principle of hierarchical trust in [Assignment: systems or system components]. | |
| SA-08(11) in SA-8 |
Inverse Modification Threshold | Implement the security design principle of inverse modification threshold in [Assignment: systems or system components]. | |
| SA-08(12) in SA-8 |
Hierarchical Protection | Implement the security design principle of hierarchical protection in [Assignment: systems or system components]. | |
| SA-08(13) in SA-8 |
Minimized Security Elements | Implement the security design principle of minimized security elements in [Assignment: systems or system components]. | |
| SA-08(14) in SA-8 |
Least Privilege | Implement the security design principle of least privilege in [Assignment: systems or system components]. | |
| SA-08(15) in SA-8 |
Predicate Permission | Implement the security design principle of predicate permission in [Assignment: systems or system components]. | |
| SA-08(16) in SA-8 |
Self-reliant Trustworthiness | Implement the security design principle of self-reliant trustworthiness in [Assignment: systems or system components]. | |
| SA-08(17) in SA-8 |
Secure Distributed Composition | Implement the security design principle of secure distributed composition in [Assignment: systems or system components]. | |
| SA-08(18) in SA-8 |
Trusted Communications Channels | Implement the security design principle of trusted communications channels in [Assignment: systems or system components]. | |
| SA-08(19) in SA-8 |
Continuous Protection | Implement the security design principle of continuous protection in [Assignment: systems or system components]. | |
| SA-08(20) in SA-8 |
Secure Metadata Management | Implement the security design principle of secure metadata management in [Assignment: systems or system components]. | |
| SA-08(21) in SA-8 |
Self-analysis | Implement the security design principle of self-analysis in [Assignment: systems or system components]. | |
| SA-08(22) in SA-8 |
Accountability and Traceability | Implement the security design principle of accountability and traceability in [Assignment: organization-defined systems or system components]. | |
| SA-08(23) in SA-8 |
Secure Defaults | Implement the security design principle of secure defaults in [Assignment: systems or system components]. | |
| SA-08(24) in SA-8 |
Secure Failure and Recovery | Implement the security design principle of secure failure and recovery in [Assignment: organization-defined systems or system components]. | |
| SA-08(25) in SA-8 |
Economic Security | Implement the security design principle of economic security in [Assignment: systems or system components]. | |
| SA-08(26) in SA-8 |
Performance Security | Implement the security design principle of performance security in [Assignment: systems or system components]. | |
| SA-08(27) in SA-8 |
Human Factored Security | Implement the security design principle of human factored security in [Assignment: systems or system components]. | |
| SA-08(28) in SA-8 |
Acceptable Security | Implement the security design principle of acceptable security in [Assignment: systems or system components]. | |
| SA-08(29) in SA-8 |
Repeatable and Documented Procedures | Implement the security design principle of repeatable and documented procedures in [Assignment: systems or system components]. | |
| SA-08(30) in SA-8 |
Procedural Rigor | Implement the security design principle of procedural rigor in [Assignment: systems or system components]. | |
| SA-08(31) in SA-8 |
Secure System Modification | Implement the security design principle of secure system modification in [Assignment: systems or system components]. | |
| SA-08(32) in SA-8 |
Sufficient Documentation | Implement the security design principle of sufficient documentation in [Assignment: systems or system components]. | |
| SA-08(33) in SA-8 |
Minimization | Implement the privacy principle of minimization using [Assignment: processes]. | |
| SA-09 | External System Services | a. Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: [Assignment: controls]; b. Define and document organizational oversight and user roles and | |
| SA-09(01) in SA-9 |
Risk Assessments and Organizational Approvals | (a) Conduct an organizational assessment of risk prior to the acquisition or outsourcing of information security services; and (b) Verify that the acquisition or outsourcing of dedicated information security services is approved by [Assignm | |
| SA-09(02) in SA-9 |
Identification of Functions, Ports, Protocols, and Services | Require providers of the following external system services to identify the functions, ports, protocols, and other services required for the use of such services: [Assignment: external system services]. | |
| SA-09(03) in SA-9 |
Establish and Maintain Trust Relationship with Providers | Establish, document, and maintain trust relationships with external service providers based on the following requirements, properties, factors, or conditions: [Assignment: organization-defined security and privacy requirements, properties, | |
| SA-09(04) in SA-9 |
Consistent Interests of Consumers and Providers | Take the following actions to verify that the interests of [Assignment: external service providers] are consistent with and reflect organizational interests: [Assignment: actions]. | |
| SA-09(05) in SA-9 |
Processing, Storage, and Service Location | Restrict the location of [Selection (one or more): information processing; information or data; system services] to [Assignment: locations] based on [Assignment: requirements]. | |
| SA-09(06) in SA-9 |
Organization-controlled Cryptographic Keys | Maintain exclusive control of cryptographic keys for encrypted material stored or transmitted through an external system. | |
| SA-09(07) in SA-9 |
Organization-controlled Integrity Checking | Provide the capability to check the integrity of information while it resides in the external system. | |
| SA-09(08) in SA-9 |
Processing and Storage Location — U.S. Jurisdiction | Restrict the geographic location of information processing and data storage to facilities located within in the legal jurisdictional boundary of the United States. | |
| SA-10 | Developer Configuration Management | Require the developer of the system, system component, or system service to: a. Perform configuration management during system, component, or service [Selection (one or more): design; development; implementation; operation; disposal]; b. Do | |
| SA-10(01) in SA-10 |
Software and Firmware Integrity Verification | Require the developer of the system, system component, or system service to enable integrity verification of software and firmware components. | |
| SA-10(02) in SA-10 |
Alternative Configuration Management Processes | Provide an alternate configuration management process using organizational personnel in the absence of a dedicated developer configuration management team. | |
| SA-10(03) in SA-10 |
Hardware Integrity Verification | Require the developer of the system, system component, or system service to enable integrity verification of hardware components. | |
| SA-10(04) in SA-10 |
Trusted Generation | Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of security-relevant hardware descriptions, source code, and object code with previous versions. | |
| SA-10(05) in SA-10 |
Mapping Integrity for Version Control | Require the developer of the system, system component, or system service to maintain the integrity of the mapping between the master build data describing the current version of security-relevant hardware, software, and firmware and the on- | |
| SA-10(06) in SA-10 |
Trusted Distribution | Require the developer of the system, system component, or system service to execute procedures for ensuring that security-relevant hardware, software, and firmware updates distributed to the organization are exactly as specified by the mast | |
| SA-10(07) in SA-10 |
Security and Privacy Representatives | Require [Assignment: organization-defined security and privacy representatives] to be included in the [Assignment: organization-defined configuration change management and control process]. | |
| SA-11 | Developer Testing and Evaluation | Require the developer of the system, system component, or system service, at all post-design stages of the system development life cycle, to: a. Develop and implement a plan for ongoing security and privacy control assessments; b. Perform [ | |
| SA-11(01) in SA-11 |
Static Code Analysis | Require the developer of the system, system component, or system service to employ static code analysis tools to identify common flaws and document the results of the analysis. | |
| SA-11(02) in SA-11 |
Threat Modeling and Vulnerability Analyses | Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analyses during development and the subsequent testing and evaluation of the system, component, or service that: (a) Uses | |
| SA-11(03) in SA-11 |
Independent Verification of Assessment Plans and Evidence | (a) Require an independent agent satisfying [Assignment: independence criteria] to verify the correct implementation of the developer security and privacy assessment plans and the evidence produced during testing and evaluation; and (b) Ver | |
| SA-11(04) in SA-11 |
Manual Code Reviews | Require the developer of the system, system component, or system service to perform a manual code review of [Assignment: specific code] using the following processes, procedures, and/or techniques: [Assignment: processes, procedures, and/or | |
| SA-11(05) in SA-11 |
Penetration Testing | Require the developer of the system, system component, or system service to perform penetration testing: (a) At the following level of rigor: [Assignment: organization-defined breadth and depth of testing] ; and (b) Under the following cons | |
| SA-11(06) in SA-11 |
Attack Surface Reviews | Require the developer of the system, system component, or system service to perform attack surface reviews. | |
| SA-11(07) in SA-11 |
Verify Scope of Testing and Evaluation | Require the developer of the system, system component, or system service to verify that the scope of testing and evaluation provides complete coverage of the required controls at the following level of rigor: [Assignment: organization-defin | |
| SA-11(08) in SA-11 |
Dynamic Code Analysis | Require the developer of the system, system component, or system service to employ dynamic code analysis tools to identify common flaws and document the results of the analysis. | |
| SA-11(09) in SA-11 |
Interactive Application Security Testing | Require the developer of the system, system component, or system service to employ interactive application security testing tools to identify flaws and document the results. | |
| SA-12 | Supply Chain Protection withdrawn | ||
| SA-12(01) in SA-12 |
Acquisition Strategies / Tools / Methods withdrawn | ||
| SA-12(02) in SA-12 |
Supplier Reviews withdrawn | ||
| SA-12(03) in SA-12 |
Trusted Shipping and Warehousing withdrawn | ||
| SA-12(04) in SA-12 |
Diversity of Suppliers withdrawn | ||
| SA-12(05) in SA-12 |
Limitation of Harm withdrawn | ||
| SA-12(06) in SA-12 |
Minimizing Procurement Time withdrawn | ||
| SA-12(07) in SA-12 |
Assessments Prior to Selection / Acceptance / Update withdrawn | ||
| SA-12(08) in SA-12 |
Use of All-source Intelligence withdrawn | ||
| SA-12(09) in SA-12 |
Operations Security withdrawn | ||
| SA-12(10) in SA-12 |
Validate as Genuine and Not Altered withdrawn | ||
| SA-12(11) in SA-12 |
Penetration Testing / Analysis of Elements, Processes, and Actors withdrawn | ||
| SA-12(12) in SA-12 |
Inter-organizational Agreements withdrawn | ||
| SA-12(13) in SA-12 |
Critical Information System Components withdrawn | ||
| SA-12(14) in SA-12 |
Identity and Traceability withdrawn | ||
| SA-12(15) in SA-12 |
Processes to Address Weaknesses or Deficiencies withdrawn | ||
| SA-13 | Trustworthiness withdrawn | ||
| SA-14 | Criticality Analysis withdrawn | ||
| SA-14(01) in SA-14 |
Critical Components with No Viable Alternative Sourcing withdrawn | ||
| SA-15 | Development Process, Standards, and Tools | a. Require the developer of the system, system component, or system service to follow a documented development process that: 1. Explicitly addresses security and privacy requirements; 2. Identifies the standards and tools used in the develo | |
| SA-15(01) in SA-15 |
Quality Metrics | Require the developer of the system, system component, or system service to: (a) Define quality metrics at the beginning of the development process; and (b) Provide evidence of meeting the quality metrics [Selection (one or more): {{ insert | |
| SA-15(02) in SA-15 |
Security and Privacy Tracking Tools | Require the developer of the system, system component, or system service to select and employ security and privacy tracking tools for use during the development process. | |
| SA-15(03) in SA-15 |
Criticality Analysis | Require the developer of the system, system component, or system service to perform a criticality analysis: (a) At the following decision points in the system development life cycle: [Assignment: decision points] ; and (b) At the following | |
| SA-15(04) in SA-15 |
Threat Modeling and Vulnerability Analysis withdrawn | ||
| SA-15(05) in SA-15 |
Attack Surface Reduction | Require the developer of the system, system component, or system service to reduce attack surfaces to [Assignment: thresholds]. | |
| SA-15(06) in SA-15 |
Continuous Improvement | Require the developer of the system, system component, or system service to implement an explicit process to continuously improve the development process. | |
| SA-15(07) in SA-15 |
Automated Vulnerability Analysis | Require the developer of the system, system component, or system service [Assignment: frequency] to: (a) Perform an automated vulnerability analysis using [Assignment: tools]; (b) Determine the exploitation potential for discovered vulnerab | |
| SA-15(08) in SA-15 |
Reuse of Threat and Vulnerability Information | Require the developer of the system, system component, or system service to use threat modeling and vulnerability analyses from similar systems, components, or services to inform the current development process. | |
| SA-15(09) in SA-15 |
Use of Live Data withdrawn | ||
| SA-15(10) in SA-15 |
Incident Response Plan | Require the developer of the system, system component, or system service to provide, implement, and test an incident response plan. | |
| SA-15(11) in SA-15 |
Archive System or Component | Require the developer of the system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security and privacy review. | |
| SA-15(12) in SA-15 |
Minimize Personally Identifiable Information | Require the developer of the system or system component to minimize the use of personally identifiable information in development and test environments. | |
| SA-15(13) in SA-15 |
Logging Syntax | Require the developer of the system or system component to minimize the use of personally identifiable information in development and test environments. | |
| SA-16 | Developer-provided Training | Require the developer of the system, system component, or system service to provide the following training on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms: [Assignment: trainin | |
| SA-17 | Developer Security and Privacy Architecture and Design | Require the developer of the system, system component, or system service to produce a design specification and security and privacy architecture that: a. Is consistent with the organization’s security and privacy architecture that is an int | |
| SA-17(01) in SA-17 |
Formal Policy Model | Require the developer of the system, system component, or system service to: (a) Produce, as an integral part of the development process, a formal policy model describing the [Assignment: organization-defined elements of organizational secu | |
| SA-17(02) in SA-17 |
Security-relevant Components | Require the developer of the system, system component, or system service to: (a) Define security-relevant hardware, software, and firmware; and (b) Provide a rationale that the definition for security-relevant hardware, software, and firmwa | |
| SA-17(03) in SA-17 |
Formal Correspondence | Require the developer of the system, system component, or system service to: (a) Produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant hardware, software | |
| SA-17(04) in SA-17 |
Informal Correspondence | Require the developer of the system, system component, or system service to: (a) Produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant har | |
| SA-17(05) in SA-17 |
Conceptually Simple Design | Require the developer of the system, system component, or system service to: (a) Design and structure the security-relevant hardware, software, and firmware to use a complete, conceptually simple protection mechanism with precisely defined | |
| SA-17(06) in SA-17 |
Structure for Testing | Require the developer of the system, system component, or system service to structure security-relevant hardware, software, and firmware to facilitate testing. | |
| SA-17(07) in SA-17 |
Structure for Least Privilege | Require the developer of the system, system component, or system service to structure security-relevant hardware, software, and firmware to facilitate controlling access with least privilege. | |
| SA-17(08) in SA-17 |
Orchestration | Design [Assignment: critical systems] with coordinated behavior to implement the following capabilities: [Assignment: capabilities]. | |
| SA-17(09) in SA-17 |
Design Diversity | Use different designs for [Assignment: critical systems] to satisfy a common set of requirements or to provide equivalent functionality. | |
| SA-18 | Tamper Resistance and Detection withdrawn | ||
| SA-18(01) in SA-18 |
Multiple Phases of System Development Life Cycle withdrawn | ||
| SA-18(02) in SA-18 |
Inspection of Systems or Components withdrawn | ||
| SA-19 | Component Authenticity withdrawn | ||
| SA-19(01) in SA-19 |
Anti-counterfeit Training withdrawn | ||
| SA-19(02) in SA-19 |
Configuration Control for Component Service and Repair withdrawn | ||
| SA-19(03) in SA-19 |
Component Disposal withdrawn | ||
| SA-19(04) in SA-19 |
Anti-counterfeit Scanning withdrawn | ||
| SA-20 | Customized Development of Critical Components | Reimplement or custom develop the following critical system components: [Assignment: critical system]. | |
| SA-21 | Developer Screening | Require that the developer of [Assignment: system, systems component, or system service]: a. Has appropriate access authorizations as determined by assigned [Assignment: official government duties] ; and b. Satisfies the following additiona | |
| SA-21(01) in SA-21 |
Validation of Screening withdrawn | ||
| SA-22 | Unsupported System Components | a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for continued support for unsupported components [S | |
| SA-22(01) in SA-22 |
Alternative Sources for Continued Support withdrawn | ||
| SA-23 | Specialization | Employ [Selection (one or more): design modification; augmentation; reconfiguration] on [Assignment: systems or system components] supporting mission essential services or functions to increase the trustworthiness in those systems or compon | |
| SA-24 | Design For Cyber Resiliency | a. Design organizational systems, system components, or system services to achieve cyber resiliency by: 1. Defining the following cyber resiliency goals: [Assignment: cyber resiliency goals]. 2. Defining the following cyber resiliency objec |
147 of 1196.