---
tags:
  - Rev5
  - Controls
---

<span class="picto">:lucide-computer:{ .machine title="This content is machine-generated from FedRAMP Machine-Readable Rules." }</span>

# System and Services Acquisition (SA)

This page contains all **108** controls and control enhancements in the System and Services Acquisition (SA) family from the vendored NIST SP 800-53 Revision 5 OSCAL catalog.

!!! info "Official NIST OSCAL source"
    - **Catalog version:** 5.2.0
    - **OSCAL version:** 1.2.2
    - **Catalog last modified:** May 11, 2026

## SA-01 (Policy and Procedures) { #sa-01 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    - **a.** Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
        - **1.** [Selection: one or more of: organization-level; mission/business process-level; system-level] system and services acquisition policy that:
            - **(a)** Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            - **(b)** Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
        - **2.** Procedures to facilitate the implementation of the system and services acquisition policy and the associated system and services acquisition controls;
    - **b.** Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures; and
    - **c.** Review and update the current system and services acquisition:
        - **1.** Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and
        - **2.** Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-1)

---

## SA-02 (Allocation of Resources) { #sa-02 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    - **a.** Determine the high-level information security and privacy requirements for the system or system service in mission and business process planning;
    - **b.** Determine, document, and allocate the resources required to protect the system or system service as part of the organizational capital planning and investment control process; and
    - **c.** Establish a discrete line item for information security and privacy in organizational programming and budgeting documentation.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-2)

---

## SA-03 (System Development Life Cycle) { #sa-03 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    - **a.** Acquire, develop, and manage the system using [Assignment: organization-defined system-development life cycle] that incorporates information security and privacy considerations;
    - **b.** Define and document information security and privacy roles and responsibilities throughout the system development life cycle;
    - **c.** Identify individuals having information security and privacy roles and responsibilities; and
    - **d.** Integrate the organizational information security and privacy risk management process into system development life cycle activities.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-3)

---

## SA-03 (01) (Manage Preproduction Environment) { #sa-03-01 }

!!! quote ""
    Protect system preproduction environments commensurate with risk throughout the system development life cycle for the system, system component, or system service.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-3-1)

---

## SA-03 (02) (Use of Live or Operational Data) { #sa-03-02 }

!!! quote ""
    - **(a)** Approve, document, and control the use of live data in preproduction environments for the system, system component, or system service; and
    - **(b)** Protect preproduction environments for the system, system component, or system service at the same impact or classification level as any live data in use within the preproduction environments.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-3-2)

---

## SA-03 (03) (Technology Refresh) { #sa-03-03 }

!!! quote ""
    Plan for and implement a technology refresh schedule for the system throughout the system development life cycle.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-3-3)

---

## SA-04 (Acquisition Process) { #sa-04 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Include the following requirements, descriptions, and criteria, explicitly or by reference, using [Selection: one or more of: standardized contract language] in the acquisition contract for the system, system component, or system service:
    
    - **a.** Security and privacy functional requirements;
    - **b.** Strength of mechanism requirements;
    - **c.** Security and privacy assurance requirements;
    - **d.** Controls needed to satisfy the security and privacy requirements.
    - **e.** Security and privacy documentation requirements;
    - **f.** Requirements for protecting security and privacy documentation;
    - **g.** Description of the system development environment and environment in which the system is intended to operate;
    - **h.** Allocation of responsibility or identification of parties responsible for information security, privacy, and supply chain risk management; and
    - **i.** Acceptance criteria.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-4)

---

## SA-04 (01) (Functional Properties of Controls) { #sa-04-01 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Require the developer of the system, system component, or system service to provide a description of the functional properties of the controls to be implemented.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-4-1)

---

## SA-04 (02) (Design and Implementation Information for Controls) { #sa-04-02 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Require the developer of the system, system component, or system service to provide design and implementation information for the controls that includes: [Selection: one or more of: security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics] at [Assignment: organization-defined level of detail].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-4-2)

---

## SA-04 (03) (Development Methods, Techniques, and Practices) { #sa-04-03 }

!!! quote ""
    Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes:
    
    - **(a)** [Assignment: organization-defined systems engineering methods];
    - **(b)** [Assignment: sa-04.03_odp.02]; and
    - **(c)** [Assignment: sa-04.03_odp.05].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-4-3)

---

## SA-04 (05) (System, Component, and Service Configurations) { #sa-04-05 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Require the developer of the system, system component, or system service to:
    
    - **(a)** Deliver the system, component, or service with [Assignment: organization-defined security configurations] implemented; and
    - **(b)** Use the configurations as the default for any subsequent system, component, or service reinstallation or upgrade.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-4-5)

---

## SA-04 (06) (Use of Information Assurance Products) { #sa-04-06 }

!!! quote ""
    - **(a)** Employ only government off-the-shelf or commercial off-the-shelf information assurance and information assurance-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted; and
    - **(b)** Ensure that these products have been evaluated and/or validated by NSA or in accordance with NSA-approved procedures.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-4-6)

---

## SA-04 (07) (NIAP-approved Protection Profiles) { #sa-04-07 }

!!! quote ""
    - **(a)** Limit the use of commercially provided information assurance and information assurance-enabled information technology products to those products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists; and
    - **(b)** Require, if no NIAP-approved Protection Profile exists for a specific technology type but a commercially provided information technology product relies on cryptographic functionality to enforce its security policy, that the cryptographic module is FIPS-validated or NSA-approved.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-4-7)

---

## SA-04 (08) (Continuous Monitoring Plan for Controls) { #sa-04-08 }

!!! quote ""
    Require the developer of the system, system component, or system service to produce a plan for continuous monitoring of control effectiveness that is consistent with the continuous monitoring program of the organization.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-4-8)

---

## SA-04 (09) (Functions, Ports, Protocols, and Services in Use) { #sa-04-09 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Require the developer of the system, system component, or system service to identify the functions, ports, protocols, and services intended for organizational use.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-4-9)

---

## SA-04 (10) (Use of Approved PIV Products) { #sa-04-10 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Employ only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational systems.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-4-10)

---

## SA-04 (11) (System of Records) { #sa-04-11 }

!!! quote ""
    Include [Assignment: organization-defined Privacy Act requirements] in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mission or function.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-4-11)

---

## SA-04 (12) (Data Ownership) { #sa-04-12 }

!!! quote ""
    - **(a)** Include organizational data ownership requirements in the acquisition contract; and
    - **(b)** Require all data to be removed from the contractor’s system and returned to the organization within [Assignment: organization-defined time frame].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-4-12)

---

## SA-05 (System Documentation) { #sa-05 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    - **a.** Obtain or develop administrator documentation for the system, system component, or system service that describes:
        - **1.** Secure configuration, installation, and operation of the system, component, or service;
        - **2.** Effective use and maintenance of security and privacy functions and mechanisms; and
        - **3.** Known vulnerabilities regarding configuration and use of administrative or privileged functions;
    - **b.** Obtain or develop user documentation for the system, system component, or system service that describes:
        - **1.** User-accessible security and privacy functions and mechanisms and how to effectively use those functions and mechanisms;
        - **2.** Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner and protect individual privacy; and
        - **3.** User responsibilities in maintaining the security of the system, component, or service and privacy of individuals;
    - **c.** Document attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent and take [Assignment: organization-defined actions] in response; and
    - **d.** Distribute documentation to [Assignment: organization-defined personnel or roles].

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Secure Configuration Guide rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-5)

---

## SA-08 (Security and Privacy Engineering Principles) { #sa-08 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Apply the following systems security and privacy engineering principles in the specification, design, development, implementation, and modification of the system and system components: [Assignment: organization-defined systems security and privacy engineering principles].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8)

---

## SA-08 (01) (Clear Abstractions) { #sa-08-01 }

!!! quote ""
    Implement the security design principle of clear abstractions.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-1)

---

## SA-08 (02) (Least Common Mechanism) { #sa-08-02 }

!!! quote ""
    Implement the security design principle of least common mechanism in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-2)

---

## SA-08 (03) (Modularity and Layering) { #sa-08-03 }

!!! quote ""
    Implement the security design principles of modularity and layering in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-3)

---

## SA-08 (04) (Partially Ordered Dependencies) { #sa-08-04 }

!!! quote ""
    Implement the security design principle of partially ordered dependencies in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-4)

---

## SA-08 (05) (Efficiently Mediated Access) { #sa-08-05 }

!!! quote ""
    Implement the security design principle of efficiently mediated access in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-5)

---

## SA-08 (06) (Minimized Sharing) { #sa-08-06 }

!!! quote ""
    Implement the security design principle of minimized sharing in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-6)

---

## SA-08 (07) (Reduced Complexity) { #sa-08-07 }

!!! quote ""
    Implement the security design principle of reduced complexity in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-7)

---

## SA-08 (08) (Secure Evolvability) { #sa-08-08 }

!!! quote ""
    Implement the security design principle of secure evolvability in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-8)

---

## SA-08 (09) (Trusted Components) { #sa-08-09 }

!!! quote ""
    Implement the security design principle of trusted components in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-9)

---

## SA-08 (10) (Hierarchical Trust) { #sa-08-10 }

!!! quote ""
    Implement the security design principle of hierarchical trust in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-10)

---

## SA-08 (11) (Inverse Modification Threshold) { #sa-08-11 }

!!! quote ""
    Implement the security design principle of inverse modification threshold in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-11)

---

## SA-08 (12) (Hierarchical Protection) { #sa-08-12 }

!!! quote ""
    Implement the security design principle of hierarchical protection in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-12)

---

## SA-08 (13) (Minimized Security Elements) { #sa-08-13 }

!!! quote ""
    Implement the security design principle of minimized security elements in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-13)

---

## SA-08 (14) (Least Privilege) { #sa-08-14 }

!!! quote ""
    Implement the security design principle of least privilege in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-14)

---

## SA-08 (15) (Predicate Permission) { #sa-08-15 }

!!! quote ""
    Implement the security design principle of predicate permission in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-15)

---

## SA-08 (16) (Self-reliant Trustworthiness) { #sa-08-16 }

!!! quote ""
    Implement the security design principle of self-reliant trustworthiness in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-16)

---

## SA-08 (17) (Secure Distributed Composition) { #sa-08-17 }

!!! quote ""
    Implement the security design principle of secure distributed composition in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-17)

---

## SA-08 (18) (Trusted Communications Channels) { #sa-08-18 }

!!! quote ""
    Implement the security design principle of trusted communications channels in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-18)

---

## SA-08 (19) (Continuous Protection) { #sa-08-19 }

!!! quote ""
    Implement the security design principle of continuous protection in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-19)

---

## SA-08 (20) (Secure Metadata Management) { #sa-08-20 }

!!! quote ""
    Implement the security design principle of secure metadata management in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-20)

---

## SA-08 (21) (Self-analysis) { #sa-08-21 }

!!! quote ""
    Implement the security design principle of self-analysis in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-21)

---

## SA-08 (22) (Accountability and Traceability) { #sa-08-22 }

!!! quote ""
    Implement the security design principle of accountability and traceability in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-22)

---

## SA-08 (23) (Secure Defaults) { #sa-08-23 }

!!! quote ""
    Implement the security design principle of secure defaults in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-23)

---

## SA-08 (24) (Secure Failure and Recovery) { #sa-08-24 }

!!! quote ""
    Implement the security design principle of secure failure and recovery in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-24)

---

## SA-08 (25) (Economic Security) { #sa-08-25 }

!!! quote ""
    Implement the security design principle of economic security in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-25)

---

## SA-08 (26) (Performance Security) { #sa-08-26 }

!!! quote ""
    Implement the security design principle of performance security in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-26)

---

## SA-08 (27) (Human Factored Security) { #sa-08-27 }

!!! quote ""
    Implement the security design principle of human factored security in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-27)

---

## SA-08 (28) (Acceptable Security) { #sa-08-28 }

!!! quote ""
    Implement the security design principle of acceptable security in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-28)

---

## SA-08 (29) (Repeatable and Documented Procedures) { #sa-08-29 }

!!! quote ""
    Implement the security design principle of repeatable and documented procedures in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-29)

---

## SA-08 (30) (Procedural Rigor) { #sa-08-30 }

!!! quote ""
    Implement the security design principle of procedural rigor in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-30)

---

## SA-08 (31) (Secure System Modification) { #sa-08-31 }

!!! quote ""
    Implement the security design principle of secure system modification in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-31)

---

## SA-08 (32) (Sufficient Documentation) { #sa-08-32 }

!!! quote ""
    Implement the security design principle of sufficient documentation in [Assignment: organization-defined systems or system components].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-32)

---

## SA-08 (33) (Minimization) { #sa-08-33 }

!!! quote ""
    Implement the privacy principle of minimization using [Assignment: organization-defined processes].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-8-33)

---

## SA-09 (External System Services) { #sa-09 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    - **a.** Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: [Assignment: organization-defined controls];
    - **b.** Define and document organizational oversight and user roles and responsibilities with regard to external system services; and
    - **c.** Employ the following processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis: [Assignment: organization-defined processes, methods, and techniques].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-9)

---

## SA-09 (01) (Risk Assessments and Organizational Approvals) { #sa-09-01 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    - **(a)** Conduct an organizational assessment of risk prior to the acquisition or outsourcing of information security services; and
    - **(b)** Verify that the acquisition or outsourcing of dedicated information security services is approved by [Assignment: organization-defined personnel or roles].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-9-1)

---

## SA-09 (02) (Identification of Functions, Ports, Protocols, and Services) { #sa-09-02 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Require providers of the following external system services to identify the functions, ports, protocols, and other services required for the use of such services: [Assignment: organization-defined external system services].

    ---

    !!! info ""
        **FedRAMP Parameters**

        | Parameter ID | NIST assignment | FedRAMP value |
        | --- | --- | --- |
        | `sa-09.02_odp` | external system services | all external systems where federal customer data is processed or stored |

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-9-2)

---

## SA-09 (03) (Establish and Maintain Trust Relationship with Providers) { #sa-09-03 }

!!! quote ""
    Establish, document, and maintain trust relationships with external service providers based on the following requirements, properties, factors, or conditions: [Assignment: organization-defined security and privacy requirements, properties, factors, or conditions defining acceptable trust relationships].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-9-3)

---

## SA-09 (04) (Consistent Interests of Consumers and Providers) { #sa-09-04 }

!!! quote ""
    Take the following actions to verify that the interests of [Assignment: organization-defined external service providers] are consistent with and reflect organizational interests: [Assignment: organization-defined actions].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-9-4)

---

## SA-09 (05) (Processing, Storage, and Service Location) { #sa-09-05 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Restrict the location of [Selection: one or more of: information processing; information or data; system services] to [Assignment: organization-defined locations] based on [Assignment: organization-defined requirements].

    ---

    !!! info ""
        === "Class C"
            **FedRAMP Parameters**

            | Parameter ID | NIST assignment | FedRAMP value |
            | --- | --- | --- |
            | `sa-09.05_odp.01` | one or more of: information processing; information or data; system services | information processing, information or data, AND system services |
            | `sa-09.05_odp.03` | requirements | all federal customer data |

        === "Class D"
            **FedRAMP Parameters**

            | Parameter ID | NIST assignment | FedRAMP value |
            | --- | --- | --- |
            | `sa-09.05_odp.01` | one or more of: information processing; information or data; system services | information processing, information or data, AND system services |
            | `sa-09.05_odp.02` | locations | U.S./U.S. Territories or geographic locations where there is U.S. jurisdiction |
            | `sa-09.05_odp.03` | requirements | all federal customer data |

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-9-5)

---

## SA-09 (06) (Organization-controlled Cryptographic Keys) { #sa-09-06 }

!!! quote ""
    Maintain exclusive control of cryptographic keys for encrypted material stored or transmitted through an external system.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-9-6)

---

## SA-09 (07) (Organization-controlled Integrity Checking) { #sa-09-07 }

!!! quote ""
    Provide the capability to check the integrity of information while it resides in the external system.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-9-7)

---

## SA-09 (08) (Processing and Storage Location — U.S. Jurisdiction) { #sa-09-08 }

!!! quote ""
    Restrict the geographic location of information processing and data storage to facilities located within in the legal jurisdictional boundary of the United States.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-9-8)

---

## SA-10 (Developer Configuration Management) { #sa-10 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Require the developer of the system, system component, or system service to:
    
    - **a.** Perform configuration management during system, component, or service [Selection: one or more of: design; development; implementation; operation; disposal];
    - **b.** Document, manage, and control the integrity of changes to [Assignment: organization-defined configuration items];
    - **c.** Implement only organization-approved changes to the system, component, or service;
    - **d.** Document approved changes to the system, component, or service and the potential security and privacy impacts of such changes; and
    - **e.** Track security flaws and flaw resolution within the system, component, or service and report findings to [Assignment: organization-defined personnel].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-10)

---

## SA-10 (01) (Software and Firmware Integrity Verification) { #sa-10-01 }

!!! quote ""
    Require the developer of the system, system component, or system service to enable integrity verification of software and firmware components.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-10-1)

---

## SA-10 (02) (Alternative Configuration Management Processes) { #sa-10-02 }

!!! quote ""
    Provide an alternate configuration management process using organizational personnel in the absence of a dedicated developer configuration management team.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-10-2)

---

## SA-10 (03) (Hardware Integrity Verification) { #sa-10-03 }

!!! quote ""
    Require the developer of the system, system component, or system service to enable integrity verification of hardware components.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-10-3)

---

## SA-10 (04) (Trusted Generation) { #sa-10-04 }

!!! quote ""
    Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of security-relevant hardware descriptions, source code, and object code with previous versions.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-10-4)

---

## SA-10 (05) (Mapping Integrity for Version Control) { #sa-10-05 }

!!! quote ""
    Require the developer of the system, system component, or system service to maintain the integrity of the mapping between the master build data describing the current version of security-relevant hardware, software, and firmware and the on-site master copy of the data for the current version.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-10-5)

---

## SA-10 (06) (Trusted Distribution) { #sa-10-06 }

!!! quote ""
    Require the developer of the system, system component, or system service to execute procedures for ensuring that security-relevant hardware, software, and firmware updates distributed to the organization are exactly as specified by the master copies.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-10-6)

---

## SA-10 (07) (Security and Privacy Representatives) { #sa-10-07 }

!!! quote ""
    Require [Assignment: organization-defined security and privacy representatives] to be included in the [Assignment: organization-defined configuration change management and control process].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-10-7)

---

## SA-11 (Developer Testing and Evaluation) { #sa-11 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Require the developer of the system, system component, or system service, at all post-design stages of the system development life cycle, to:
    
    - **a.** Develop and implement a plan for ongoing security and privacy control assessments;
    - **b.** Perform [Selection: one or more of: unit; integration; system; regression] testing/evaluation [Assignment: organization-defined frequency to conduct] at [Assignment: organization-defined depth and coverage];
    - **c.** Produce evidence of the execution of the assessment plan and the results of the testing and evaluation;
    - **d.** Implement a verifiable flaw remediation process; and
    - **e.** Correct flaws identified during testing and evaluation.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-11)

---

## SA-11 (01) (Static Code Analysis) { #sa-11-01 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Require the developer of the system, system component, or system service to employ static code analysis tools to identify common flaws and document the results of the analysis.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-11-1)

---

## SA-11 (02) (Threat Modeling and Vulnerability Analyses) { #sa-11-02 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analyses during development and the subsequent testing and evaluation of the system, component, or service that:
    
    - **(a)** Uses the following contextual information: [Assignment: organization-defined information];
    - **(b)** Employs the following tools and methods: [Assignment: organization-defined tools and methods];
    - **(c)** Conducts the modeling and analyses at the following level of rigor: [Assignment: organization-defined breadth and depth of modeling and analyses]; and
    - **(d)** Produces evidence that meets the following acceptance criteria: [Assignment: organization-defined acceptance criteria].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-11-2)

---

## SA-11 (03) (Independent Verification of Assessment Plans and Evidence) { #sa-11-03 }

!!! quote ""
    - **(a)** Require an independent agent satisfying [Assignment: organization-defined independence criteria] to verify the correct implementation of the developer security and privacy assessment plans and the evidence produced during testing and evaluation; and
    - **(b)** Verify that the independent agent is provided with sufficient information to complete the verification process or granted the authority to obtain such information.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-11-3)

---

## SA-11 (04) (Manual Code Reviews) { #sa-11-04 }

!!! quote ""
    Require the developer of the system, system component, or system service to perform a manual code review of [Assignment: organization-defined specific code] using the following processes, procedures, and/or techniques: [Assignment: organization-defined processes, procedures, and/or techniques].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-11-4)

---

## SA-11 (05) (Penetration Testing) { #sa-11-05 }

!!! quote ""
    Require the developer of the system, system component, or system service to perform penetration testing:
    
    - **(a)** At the following level of rigor: [Assignment: organization-defined breadth and depth of testing]; and
    - **(b)** Under the following constraints: [Assignment: organization-defined constraints].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-11-5)

---

## SA-11 (06) (Attack Surface Reviews) { #sa-11-06 }

!!! quote ""
    Require the developer of the system, system component, or system service to perform attack surface reviews.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-11-6)

---

## SA-11 (07) (Verify Scope of Testing and Evaluation) { #sa-11-07 }

!!! quote ""
    Require the developer of the system, system component, or system service to verify that the scope of testing and evaluation provides complete coverage of the required controls at the following level of rigor: [Assignment: organization-defined breadth and depth of testing and evaluation].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-11-7)

---

## SA-11 (08) (Dynamic Code Analysis) { #sa-11-08 }

!!! quote ""
    Require the developer of the system, system component, or system service to employ dynamic code analysis tools to identify common flaws and document the results of the analysis.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-11-8)

---

## SA-11 (09) (Interactive Application Security Testing) { #sa-11-09 }

!!! quote ""
    Require the developer of the system, system component, or system service to employ interactive application security testing tools to identify flaws and document the results.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-11-9)

---

## SA-15 (Development Process, Standards, and Tools) { #sa-15 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    - **a.** Require the developer of the system, system component, or system service to follow a documented development process that:
        - **1.** Explicitly addresses security and privacy requirements;
        - **2.** Identifies the standards and tools used in the development process;
        - **3.** Documents the specific tool options and tool configurations used in the development process; and
        - **4.** Documents, manages, and ensures the integrity of changes to the process and/or tools used in development; and
    - **b.** Review the development process, standards, tools, tool options, and tool configurations [Assignment: organization-defined frequency] to determine if the process, standards, tools, tool options and tool configurations selected and employed can satisfy the following security and privacy requirements: [Assignment: organization-defined security and privacy requirements].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-15)

---

## SA-15 (01) (Quality Metrics) { #sa-15-01 }

!!! quote ""
    Require the developer of the system, system component, or system service to:
    
    - **(a)** Define quality metrics at the beginning of the development process; and
    - **(b)** Provide evidence of meeting the quality metrics [Selection: one or more of: upon delivery].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-15-1)

---

## SA-15 (02) (Security and Privacy Tracking Tools) { #sa-15-02 }

!!! quote ""
    Require the developer of the system, system component, or system service to select and employ security and privacy tracking tools for use during the development process.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-15-2)

---

## SA-15 (03) (Criticality Analysis) { #sa-15-03 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Require the developer of the system, system component, or system service to perform a criticality analysis:
    
    - **(a)** At the following decision points in the system development life cycle: [Assignment: organization-defined decision points]; and
    - **(b)** At the following level of rigor: [Assignment: organization-defined breadth and depth of criticality analysis].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-15-3)

---

## SA-15 (05) (Attack Surface Reduction) { #sa-15-05 }

!!! quote ""
    Require the developer of the system, system component, or system service to reduce attack surfaces to [Assignment: organization-defined thresholds].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-15-5)

---

## SA-15 (06) (Continuous Improvement) { #sa-15-06 }

!!! quote ""
    Require the developer of the system, system component, or system service to implement an explicit process to continuously improve the development process.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-15-6)

---

## SA-15 (07) (Automated Vulnerability Analysis) { #sa-15-07 }

!!! quote ""
    Require the developer of the system, system component, or system service [Assignment: organization-defined frequency] to:
    
    - **(a)** Perform an automated vulnerability analysis using [Assignment: organization-defined tools];
    - **(b)** Determine the exploitation potential for discovered vulnerabilities;
    - **(c)** Determine potential risk mitigations for delivered vulnerabilities; and
    - **(d)** Deliver the outputs of the tools and results of the analysis to [Assignment: organization-defined personnel or roles].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-15-7)

---

## SA-15 (08) (Reuse of Threat and Vulnerability Information) { #sa-15-08 }

!!! quote ""
    Require the developer of the system, system component, or system service to use threat modeling and vulnerability analyses from similar systems, components, or services to inform the current development process.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-15-8)

---

## SA-15 (10) (Incident Response Plan) { #sa-15-10 }

!!! quote ""
    Require the developer of the system, system component, or system service to provide, implement, and test an incident response plan.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-15-10)

---

## SA-15 (11) (Archive System or Component) { #sa-15-11 }

!!! quote ""
    Require the developer of the system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security and privacy review.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-15-11)

---

## SA-15 (12) (Minimize Personally Identifiable Information) { #sa-15-12 }

!!! quote ""
    Require the developer of the system or system component to minimize the use of personally identifiable information in development and test environments.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-15-12)

---

## SA-15 (13) (Logging Syntax) { #sa-15-13 }

!!! quote ""
    Require the developer of the system or system component to minimize the use of personally identifiable information in development and test environments.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-15-13)

---

## SA-16 (Developer-provided Training) { #sa-16 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Require the developer of the system, system component, or system service to provide the following training on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms: [Assignment: organization-defined training].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-16)

---

## SA-17 (Developer Security and Privacy Architecture and Design) { #sa-17 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Require the developer of the system, system component, or system service to produce a design specification and security and privacy architecture that:
    
    - **a.** Is consistent with the organization’s security and privacy architecture that is an integral part the organization’s enterprise architecture;
    - **b.** Accurately and completely describes the required security and privacy functionality, and the allocation of controls among physical and logical components; and
    - **c.** Expresses how individual security and privacy functions, mechanisms, and services work together to provide required security and privacy capabilities and a unified approach to protection.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-17)

---

## SA-17 (01) (Formal Policy Model) { #sa-17-01 }

!!! quote ""
    Require the developer of the system, system component, or system service to:
    
    - **(a)** Produce, as an integral part of the development process, a formal policy model describing the [Assignment: organization-defined elements of organizational security and privacy policy] to be enforced; and
    - **(b)** Prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security and privacy policy when implemented.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-17-1)

---

## SA-17 (02) (Security-relevant Components) { #sa-17-02 }

!!! quote ""
    Require the developer of the system, system component, or system service to:
    
    - **(a)** Define security-relevant hardware, software, and firmware; and
    - **(b)** Provide a rationale that the definition for security-relevant hardware, software, and firmware is complete.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-17-2)

---

## SA-17 (03) (Formal Correspondence) { #sa-17-03 }

!!! quote ""
    Require the developer of the system, system component, or system service to:
    
    - **(a)** Produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of exceptions, error messages, and effects;
    - **(b)** Show via proof to the extent feasible with additional informal demonstration as necessary, that the formal top-level specification is consistent with the formal policy model;
    - **(c)** Show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant hardware, software, and firmware;
    - **(d)** Show that the formal top-level specification is an accurate description of the implemented security-relevant hardware, software, and firmware; and
    - **(e)** Describe the security-relevant hardware, software, and firmware mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant hardware, software, and firmware.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-17-3)

---

## SA-17 (04) (Informal Correspondence) { #sa-17-04 }

!!! quote ""
    Require the developer of the system, system component, or system service to:
    
    - **(a)** Produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of exceptions, error messages, and effects;
    - **(b)** Show via [Selection: one of: informal demonstration, convincing argument with formal methods as feasible] that the descriptive top-level specification is consistent with the formal policy model;
    - **(c)** Show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant hardware, software, and firmware;
    - **(d)** Show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant hardware, software, and firmware; and
    - **(e)** Describe the security-relevant hardware, software, and firmware mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant hardware, software, and firmware.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-17-4)

---

## SA-17 (05) (Conceptually Simple Design) { #sa-17-05 }

!!! quote ""
    Require the developer of the system, system component, or system service to:
    
    - **(a)** Design and structure the security-relevant hardware, software, and firmware to use a complete, conceptually simple protection mechanism with precisely defined semantics; and
    - **(b)** Internally structure the security-relevant hardware, software, and firmware with specific regard for this mechanism.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-17-5)

---

## SA-17 (06) (Structure for Testing) { #sa-17-06 }

!!! quote ""
    Require the developer of the system, system component, or system service to structure security-relevant hardware, software, and firmware to facilitate testing.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-17-6)

---

## SA-17 (07) (Structure for Least Privilege) { #sa-17-07 }

!!! quote ""
    Require the developer of the system, system component, or system service to structure security-relevant hardware, software, and firmware to facilitate controlling access with least privilege.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-17-7)

---

## SA-17 (08) (Orchestration) { #sa-17-08 }

!!! quote ""
    Design [Assignment: organization-defined critical systems] with coordinated behavior to implement the following capabilities: [Assignment: organization-defined capabilities].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-17-8)

---

## SA-17 (09) (Design Diversity) { #sa-17-09 }

!!! quote ""
    Use different designs for [Assignment: organization-defined critical systems] to satisfy a common set of requirements or to provide equivalent functionality.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-17-9)

---

## SA-20 (Customized Development of Critical Components) { #sa-20 }

!!! quote ""
    Reimplement or custom develop the following critical system components: [Assignment: organization-defined critical system].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-20)

---

## SA-21 (Developer Screening) { #sa-21 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Require that the developer of [Assignment: organization-defined system, systems component, or system service]:
    
    - **a.** Has appropriate access authorizations as determined by assigned [Assignment: organization-defined official government duties]; and
    - **b.** Satisfies the following additional personnel screening criteria: [Assignment: organization-defined additional personnel screening criteria].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-21)

---

## SA-22 (Unsupported System Components) { #sa-22 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    - **a.** Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or
    - **b.** Provide the following options for alternative sources for continued support for unsupported components [Selection: one or more of: in-house support].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-22)

---

## SA-23 (Specialization) { #sa-23 }

!!! quote ""
    Employ [Selection: one or more of: design modification; augmentation; reconfiguration] on [Assignment: organization-defined systems or system components] supporting mission essential services or functions to increase the trustworthiness in those systems or components.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-23)

---

## SA-24 (Design For Cyber Resiliency) { #sa-24 }

!!! quote ""
    - **a.** Design organizational systems, system components, or system services to achieve cyber resiliency by:
        - **1.** Defining the following cyber resiliency goals: [Assignment: organization-defined cyber resiliency goals].
        - **2.** Defining the following cyber resiliency objectives: [Assignment: organization-defined cyber resiliency objectives].
        - **3.** Defining the following cyber resiliency techniques: [Assignment: organization-defined cyber resiliency techniques].
        - **4.** Defining the following cyber resiliency implementation approaches: [Assignment: organization-defined cyber resiliency implementation approaches].
        - **5.** Defining the following cyber resiliency design principles: [Assignment: organization-defined cyber resiliency design principles].
    - **b.** Implement the selected cyber resiliency goals, objectives, techniques, implementation approaches, and design principles as part of an organizational risk management process or systems security engineering process.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/sa-24)

---
