{"data":{"id":"SA-15","name":"Development Process, Standards, and Tools","family":"SA","family_name":"System and Services Acquisition","withdrawn":false,"description":"a. Require the developer of the system, system component, or system service to follow a documented development process that:\n1. Explicitly addresses security and privacy requirements;\n2. Identifies the standards and tools used in the development process;\n3. Documents the specific tool options and tool configurations used in the development process; and\n4. Documents, manages, and ensures the integrity of changes to the process and/or tools used in development; and\nb. Review the development process, standards, tools, tool options, and tool configurations [Assignment: organization-defined frequency] to determine if the process, standards, tools, tool options and tool configurations selected and employed can satisfy the following security and privacy requirements: [Assignment: organization-defined security and privacy requirements].","supplemental_guidance":"Development tools include programming languages and computer-aided design systems. Reviews of development processes include the use of maturity models to determine the potential effectiveness of such processes. Maintaining the integrity of changes to tools and processes facilitates effective supply chain risk assessment and mitigation. Such integrity requires configuration control throughout the system development life cycle to track authorized changes and prevent unauthorized changes.","enhancements":[{"id":"SA-15(01)","name":"Quality Metrics","statement":"Require the developer of the system, system component, or system service to:\na. Define quality metrics at the beginning of the development process; and\nb. Provide evidence of meeting the quality metrics [Selection (one or more): [Assignment: organization-defined frequency]; [Assignment: organization-defined program review milestones]; upon delivery].","baselines":[]},{"id":"SA-15(02)","name":"Security and Privacy Tracking Tools","statement":"Require the developer of the system, system component, or system service to select and employ security and privacy tracking tools for use during the development process.","baselines":[]},{"id":"SA-15(03)","name":"Criticality Analysis","statement":"Require the developer of the system, system component, or system service to perform a criticality analysis:\na. At the following decision points in the system development life cycle: [Assignment: organization-defined decision points in the system development life cycle]; and\nb. At the following level of rigor: [Assignment: organization-defined breadth and depth of criticality analysis].","baselines":["moderate","high"]},{"id":"SA-15(04)","name":"Threat Modeling and Vulnerability Analysis","withdrawn":true,"incorporated_into":["SA-11(02)"]},{"id":"SA-15(05)","name":"Attack Surface Reduction","statement":"Require the developer of the system, system component, or system service to reduce attack surfaces to [Assignment: organization-defined thresholds].","baselines":[]},{"id":"SA-15(06)","name":"Continuous Improvement","statement":"Require the developer of the system, system component, or system service to implement an explicit process to continuously improve the development process.","baselines":[]},{"id":"SA-15(07)","name":"Automated Vulnerability Analysis","statement":"Require the developer of the system, system component, or system service [Assignment: organization-defined frequency] to:\na. Perform an automated vulnerability analysis using [Assignment: organization-defined tools];\nb. Determine the exploitation potential for discovered vulnerabilities;\nc. Determine potential risk mitigations for delivered vulnerabilities; and\nd. Deliver the outputs of the tools and results of the analysis to [Assignment: organization-defined personnel or roles].","baselines":[]},{"id":"SA-15(08)","name":"Reuse of Threat and Vulnerability Information","statement":"Require the developer of the system, system component, or system service to use threat modeling and vulnerability analyses from similar systems, components, or services to inform the current development process.","baselines":[]},{"id":"SA-15(09)","name":"Use of Live Data","withdrawn":true,"incorporated_into":["SA-03(02)"]},{"id":"SA-15(10)","name":"Incident Response Plan","statement":"Require the developer of the system, system component, or system service to provide, implement, and test an incident response plan.","baselines":[]},{"id":"SA-15(11)","name":"Archive System or Component","statement":"Require the developer of the system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security and privacy review.","baselines":[]},{"id":"SA-15(12)","name":"Minimize Personally Identifiable Information","statement":"Require the developer of the system or system component to minimize the use of personally identifiable information in development and test environments.","baselines":[]},{"id":"SA-15(13)","name":"Logging Syntax","statement":"Require the developer of the system, system component, or system service to use [Assignment: organization-defined secure logging format] to log [assignment: organization-defined event types] at [assignment: organization-defined level of detail].","baselines":[]}],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"SA-15","name":"Development Process, Standards, and Tools","description":"a. Require the developer of the system, system component, or system service to follow a documented development process that:\n1. Explicitly addresses security and privacy requirements;\n2. Identifies the standards and tools used in the development process;\n3. Documents the specific tool options and tool configurations used in the development process; and\n4. Documents, manages, and ensures the integrity of changes to the process and/or tools used in development; and\nb. Review the development process, standards, tools, tool options, and tool configurations [Assignment: organization-defined frequency] to determine if the process, standards, tools, tool options and tool configurations selected and employed can satisfy the following security and privacy requirements: [Assignment: organization-defined security and privacy requirements].","discussion":"Development tools include programming languages and computer-aided design systems. Reviews of development processes include the use of maturity models to determine the potential effectiveness of such processes. Maintaining the integrity of changes to tools and processes facilitates effective supply chain risk assessment and mitigation. Such integrity requires configuration control throughout the system development life cycle to track authorized changes and prevent unauthorized changes.","related_controls":["MA-06","SA-03","SA-04","SA-08","SA-10","SA-11","SR-03","SR-04","SR-05","SR-06","SR-09"],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"No significant changes from Rev 4."}},"compliance_mappings":{"iso_27001_2022":["A.5.8","A.8.25","A.8.28","A.8.30","A.8.33"],"iso_27002_2022":["8.25","8.28","8.33"],"cobit_2019":["APO11","BAI03"],"pci_dss_v4":["6.1","6.2"],"nist_csf_2":["ID.RA-09","PR.PS-06"],"cis_controls_v8":["CIS 16","CIS 16.1"],"soc2_tsc":[],"finos_ccc":[],"iso_42001_2023":[],"iec_62443":[],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":["5","6"],"pra_op_resilience":[],"bsi_grundschutz":[],"anssi":[],"osfi_b13":[],"finma_circular":[],"gdpr":[],"dora":[],"bio2":["8.25","8.28","8.33"],"rbi_csf":["Annex1.6","ITGRCA.12"],"fisc":["FISC.O10","FISC.T6"],"lgpd_bcb":[],"hkma_tme1":["TME1.3.1","TME1.3.2"],"mlps_2":["8.1.9.4"],"dnb_good_practice":["DNB.10.4"],"cra":["CRA.I.1","CRA.I.2a"],"swift_cscf":[],"cbb_tm":["TM-7"],"cbuae":["CR-6"],"nca_ecc":["1-6","2-14"],"qatar_nia":["SD"],"sama_csf":["1.4","3.2"],"uae_ia":["T10"],"bog_cisd":["CISD-SDLC"],"bom_ctrm":["3.11"],"cbe_csf":["CTO-4"],"sa_js2":["JS2-SA"],"bcbs_239":["Principle 6"],"bot_cyber":["Ch2.5","Ch6.2"],"cpmi_pfmi":["CG.ID","CG.TE"],"eba_ict":["3.4.6","3.6.2"],"ecb_croe":["CROE.2.3.4","CROE.2.6.1"],"ffiec_is":["II.C.17"],"iosco_cyber":["PROT-6"],"nydfs_500":["500.5","500.8"],"sebi_cscrf":["PR.AS","PR.IP"],"nerc_cip":[],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":["5.10"],"ferc_cip":[],"doe_c2m2":[],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":["F","H"],"fips_140":["FIPS 140-3 §7.11"],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":["CC Part 3 — SAR"],"isae_3402":[],"fca_sysc_13":[],"fda_21_cfr_11":["§11.10(a)"],"fda_cyber":["SPDF-1","ST-1"],"hitrust_csf":["10.b","10.d"],"iso_27799":["14.2","14.3"],"lloyds_ms":[],"naic_ds":["4-config"],"nhs_dspt":[],"pra_ss1_23":["P3.1","P3.3"],"solvency_ii":["EIOPA-ICT-4.11"],"owasp_masvs_v2":[],"csa_ccm_v4":["AIS-02","AIS-04"],"csa_aicm":["AIS-02","AIS-04","AIS-11","MDS-10"],"ccss_v9":["1.02.7"],"mica":[],"basel_sco60":["SCO60.51","SCO60.52"],"bssc":[],"sec_custody_digital":[],"dpdpa":[]},"attack_techniques":[{"id":"T1078","name":"Valid Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Requiring documented development processes that address security ensures that valid accounts used in development environments follow secure credential management practices, reducing exposure of development credentials."},{"id":"T1528","name":"Steal Application Access Token","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Development process standards that mandate secure token handling, short-lived credentials, and proper OAuth implementation reduce the risk of application access tokens being exposed during development."},{"id":"T1552","name":"Unsecured Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Development standards requiring secure credential management—prohibiting hardcoded secrets, mandating vault integration, and enforcing pre-commit scanning—prevent unsecured credentials from entering codebases."},{"id":"T1078.001","name":"Default Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Development process requirements that mandate changing default credentials, implementing secure initial configurations, and documenting all default accounts reduce the risk of default account exploitation in production."},{"id":"T1078.003","name":"Local Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Secure development standards requiring unique service account credentials, prohibiting shared local accounts, and mandating credential rotation prevent local account credential exposure through development artifacts."},{"id":"T1078.004","name":"Cloud Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Development process controls that mandate least-privilege cloud IAM configurations, short-lived cloud credentials, and secure service identity management reduce cloud account exposure from insecure development practices."},{"id":"T1195.001","name":"Compromise Software Dependencies and Development Tools","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Development process standards that enforce dependency integrity verification, software composition analysis, and trusted package registry usage directly mitigate supply chain compromise through development tool and dependency tampering."},{"id":"T1213.003","name":"Code Repositories","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Development standards that enforce access controls on code repositories, require branch protection, and mandate code review workflows prevent adversaries from collecting sensitive code through improperly secured repositories."},{"id":"T1552.001","name":"Credentials In Files","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Development process requirements that enforce pre-commit secret scanning, prohibit credentials in source code, and mandate external secret storage prevent credentials from being committed to files in code repositories."},{"id":"T1552.002","name":"Credentials in Registry","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Secure development standards that prohibit storing credentials in registry values and mandate secure configuration management prevent credential exposure through registry-stored development configuration data."},{"id":"T1552.004","name":"Private Keys","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Development process controls that enforce hardware-backed key storage, prohibit private keys in source repositories, and mandate certificate lifecycle management prevent private key exposure in development artifacts."},{"id":"T1552.006","name":"Group Policy Preferences","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Development standards that prohibit embedding credentials in Group Policy Preferences and mandate LAPS or certificate-based authentication prevent credential exposure through GPP-based configuration management."},{"id":"T1558.004","name":"AS-REP Roasting","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Secure development processes that enforce Kerberos pre-authentication requirements and mandate strong service account configurations during deployment prevent AS-REP roasting vulnerabilities from reaching production."},{"id":"T1574.002","name":"DLL Side-Loading","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Development process standards that enforce secure DLL loading practices, validate library dependencies, and implement manifest-based binding prevent DLL side-loading vulnerabilities from being introduced during development."}],"metadata":{"last_reviewed":"2026-10-03","review_notes":"Generated from NIST SP 800-53 Rev 5 with compliance mappings from framework-coverage data 2026-10-03: iso_27001_2022 A.5.8, A.8.30 added from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR entry 155), which OSA's mapping now takes as its base. 2026-10-03: nist_csf_2 ID.RA-09 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base. 2026-10-03: baselines --H to -MH; Rev 5 baselines --H to -MH, from NIST SP 800-53B Release 5.2.0.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-012","SP-028","SP-035","SP-041","SP-051","SP-053"]}}