ComplianceNIST 800-53 control

NIST-SA-17 Developer Security and Privacy Architecture and Design

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
SA System and Services Acquisition
Control
SA-17
ATT&CK techniques mitigated
7

Control statement

Require the developer of the system, system component, or system service to produce a design specification and security and privacy architecture that: a. Is consistent with the organization’s security and privacy architecture that is an integral part the organization’s enterprise architecture; b. Accurately and completely describes the required security and privacy functionality, and the allocation of controls among physical and logical components; and c. Expresses how individual security and privacy functions, mechanisms, and services work together to provide required security and privacy capabilities and a unified approach to protection.

Discussion

Developer security and privacy architecture and design are directed at external developers, although they could also be applied to internal (in-house) development. In contrast, [PL-8](#pl-8) is directed at internal developers to ensure that organizations develop a security and privacy architecture that is integrated with the enterprise architecture. The distinction between SA-17 and [PL-8](#pl-8) is especially important when organizations outsource the development of systems, system components, or system services and when there is a requirement to demonstrate consistency with the enterprise architecture and security and privacy architecture of the organization. [ISO 15408-2](#87087451-2af5-43d4-88c1-d66ad850f614), [ISO 15408-3](#4452efc0-e79e-47b8-aa30-b54f3ef61c2f) , and [SP 800-160-1](#e3cc0520-a366-4fc9-abc2-5272db7e3564) provide information on security architecture and design, including formal policy models, security-relevant components, formal and informal correspondence, conceptually simple design, and structuring for least privilege and testing.

ATT&CK mappings (CTID)

• T1078 Valid Accounts • T1078.001 Default Accounts • T1078.003 Local Accounts • T1078.004 Cloud Accounts • T1134.005 SID-History Injection • T1482 Domain Trust Discovery • T1574.002 DLL Side-Loading

Related

Mitigates · not in database (1)

Mitigates · MITRE ATT&CK (6)

  • T1078.001 Default Accounts sub-technique
  • T1078.003 Local Accounts sub-technique
  • T1078.004 Cloud Accounts sub-technique
  • T1134.005 SID-History Injection sub-technique
  • T1482 Domain Trust Discovery technique
  • T1078 Valid Accounts technique

Related control · Compliance (7)

  • NIST-PL-2 System Security and Privacy Plans NIST 800-53 control
  • NIST-PL-8 Security and Privacy Architectures NIST 800-53 control
  • NIST-PM-7 Enterprise Architecture NIST 800-53 control
  • NIST-SA-3 System Development Life Cycle NIST 800-53 control
  • NIST-SA-4 Acquisition Process NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control

Referenced by Compliance · enhancement of (9)

Referenced by Compliance · has member (1)

  • NIST-SA System and Services Acquisition NIST 800-53 family

Referenced by Compliance · related control (18)

  • NIST-AC-25 Reference Monitor NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-12 Information Location NIST 800-53 control
  • NIST-PL-2 System Security and Privacy Plans NIST 800-53 control
  • NIST-PL-8 Security and Privacy Architectures NIST 800-53 control
  • NIST-PM-7 Enterprise Architecture NIST 800-53 control
  • NIST-SA-11 Developer Testing and Evaluation NIST 800-53 control
  • NIST-SA-24 Design For Cyber Resiliency NIST 800-53 control
  • NIST-SA-3 System Development Life Cycle NIST 800-53 control
  • NIST-SA-4 Acquisition Process NIST 800-53 control
  • NIST-SA-5 System Documentation NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SA-8(29) Repeatable and Documented Procedures NIST 800-53 enhancement
  • NIST-SC-3 Security Function Isolation NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control