ComplianceNIST 800-53 control

NIST-SA-15 Development Process, Standards, and Tools

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
SA System and Services Acquisition
Control
SA-15
ATT&CK techniques mitigated
14

Control statement

a. Require the developer of the system, system component, or system service to follow a documented development process that: 1. Explicitly addresses security and privacy requirements; 2. Identifies the standards and tools used in the development process; 3. Documents the specific tool options and tool configurations used in the development process; and 4. Documents, manages, and ensures the integrity of changes to the process and/or tools used in development; and b. Review the development process, standards, tools, tool options, and tool configurations [Assignment: frequency] to determine if the process, standards, tools, tool options and tool configurations selected and employed can satisfy the following security and privacy requirements: [Assignment: organization-defined security and privacy requirements].

Discussion

Development tools include programming languages and computer-aided design systems. Reviews of development processes include the use of maturity models to determine the potential effectiveness of such processes. Maintaining the integrity of changes to tools and processes facilitates effective supply chain risk assessment and mitigation. Such integrity requires configuration control throughout the system development life cycle to track authorized changes and prevent unauthorized changes.

ATT&CK mappings (CTID)

• T1078 Valid Accounts • T1078.001 Default Accounts • T1078.003 Local Accounts • T1078.004 Cloud Accounts • T1195.001 Compromise Software Dependencies and Development Tools • T1213.003 Code Repositories • T1528 Steal Application Access Token • T1552 Unsecured Credentials • T1552.001 Credentials In Files • T1552.002 Credentials in Registry • T1552.004 Private Keys • T1552.006 Group Policy Preferences • T1558.004 AS-REP Roasting • T1574.002 DLL Side-Loading

Related

Mitigates · not in database (1)

Mitigates · MITRE ATT&CK (13)

  • T1213.003 Code Repositories sub-technique
  • T1558.004 AS-REP Roasting sub-technique
  • T1078.001 Default Accounts sub-technique
  • T1078.003 Local Accounts sub-technique
  • T1078.004 Cloud Accounts sub-technique
  • T1195.001 Compromise Software Dependencies and Development Tools sub-technique
  • T1552.006 Group Policy Preferences sub-technique
  • T1552 Unsecured Credentials technique
  • T1552.001 Credentials In Files sub-technique
  • T1552.002 Credentials in Registry sub-technique
  • T1552.004 Private Keys sub-technique
  • T1528 Steal Application Access Token technique
  • T1078 Valid Accounts technique

Related control · Compliance (11)

  • NIST-MA-6 Timely Maintenance NIST 800-53 control
  • NIST-SA-10 Developer Configuration Management NIST 800-53 control
  • NIST-SA-11 Developer Testing and Evaluation NIST 800-53 control
  • NIST-SA-3 System Development Life Cycle NIST 800-53 control
  • NIST-SA-4 Acquisition Process NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SR-3 Supply Chain Controls and Processes NIST 800-53 control
  • NIST-SR-4 Provenance NIST 800-53 control
  • NIST-SR-5 Acquisition Strategies, Tools, and Methods NIST 800-53 control
  • NIST-SR-6 Supplier Assessments and Reviews NIST 800-53 control
  • NIST-SR-9 Tamper Resistance and Detection NIST 800-53 control

Referenced by Compliance · enhancement of (11)

Referenced by Compliance · has member (1)

  • NIST-SA System and Services Acquisition NIST 800-53 family

Referenced by Compliance · related control (22)

  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CP-2 Contingency Plan NIST 800-53 control
  • NIST-IR-8 Incident Response Plan NIST 800-53 control
  • NIST-MA-6 Timely Maintenance NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-RA-9 Criticality Analysis NIST 800-53 control
  • NIST-SA-10 Developer Configuration Management NIST 800-53 control
  • NIST-SA-11 Developer Testing and Evaluation NIST 800-53 control
  • NIST-SA-11(6) Attack Surface Reviews NIST 800-53 enhancement
  • NIST-SA-11(7) Verify Scope of Testing and Evaluation NIST 800-53 enhancement
  • NIST-SA-3 System Development Life Cycle NIST 800-53 control
  • NIST-SA-4 Acquisition Process NIST 800-53 control
  • NIST-SA-5 System Documentation NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SA-8(29) Repeatable and Documented Procedures NIST 800-53 enhancement
  • NIST-SC-3 Security Function Isolation NIST 800-53 control
  • NIST-SI-2(7) Root Cause Analysis NIST 800-53 enhancement
  • NIST-SR-3 Supply Chain Controls and Processes NIST 800-53 control
  • NIST-SR-5 Acquisition Strategies, Tools, and Methods NIST 800-53 control
  • NIST-SR-9 Tamper Resistance and Detection NIST 800-53 control