SA-15 Development Process, Standards, and Tools
Control
Require the developer of the system, system component, or system service to follow a documented development process that:
Explicitly addresses security and privacy requirements;
Identifies the standards and tools used in the development process;
Documents the specific tool options and tool configurations used in the development process; and
Documents, manages, and ensures the integrity of changes to the process and/or tools used in development; and
Review the development process, standards, tools, tool options, and tool configurations [Assignment: frequency] to determine if the process, standards, tools, tool options and tool configurations selected and employed can satisfy the following security and privacy requirements: [Assignment: organization-defined security and privacy requirements].
Discussion
Development tools include programming languages and computer-aided design systems. Reviews of development processes include the use of maturity models to determine the potential effectiveness of such processes. Maintaining the integrity of changes to tools and processes facilitates effective supply chain risk assessment and mitigation. Such integrity requires configuration control throughout the system development life cycle to track authorized changes and prevent unauthorized changes.
Control enhancements (13)
- SA-15(1)Quality Metrics
- SA-15(2)Security and Privacy Tracking Tools
- SA-15(3)Criticality AnalysisMODERATEHIGH
- SA-15(4)Threat Modeling and Vulnerability Analysis
- SA-15(5)Attack Surface Reduction
- SA-15(6)Continuous Improvement
- SA-15(7)Automated Vulnerability Analysis
- SA-15(8)Reuse of Threat and Vulnerability Information
- SA-15(9)Use of Live Data
- SA-15(10)Incident Response Plan
- SA-15(11)Archive System or Component
- SA-15(12)Minimize Personally Identifiable Information
- SA-15(13)Logging Syntax
Related controls
Need SA-15 implemented and evidenced?
We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.
Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.