# SA-15 Development Process, Standards, and Tools

NIST SP 800-53 control. Family: SA System and Services Acquisition. Function: preventative. Baselines: moderate, high. Mapping licence: CC BY-SA 4.0.

Statement: a. Require the developer of the system, system component, or system service to follow a documented development process that: 1. Explicitly addresses security and privacy requirements; 2. Identifies the standards and tools used in the development process; 3. Documents the specific tool options and tool configurations used in the development process; and 4. Documents, manages, and ensures the integrity of changes to the process and/or tools used in development; and b. Review the development process, standards, tools, tool options, and tool configurations [Assignment: organization-defined frequency] to determine if the process, standards, tools, tool options and tool configurations selected and employed can satisfy the following security and privacy requirements: [Assignment: organization-defined security and privacy requirements].
Guidance: Development tools include programming languages and computer-aided design systems. Reviews of development processes include the use of maturity models to determine the potential effectiveness of such processes. Maintaining the integrity of changes to tools and processes facilitates effective supply chain risk assessment and mitigation. Such integrity requires configuration control throughout the system development life cycle to track authorized changes and prevent unauthorized changes.

## Enhancements (11)
- SA-15(01) Quality Metrics
- SA-15(02) Security and Privacy Tracking Tools
- SA-15(03) Criticality Analysis. Baselines: moderate, high
- SA-15(05) Attack Surface Reduction
- SA-15(06) Continuous Improvement
- SA-15(07) Automated Vulnerability Analysis
- SA-15(08) Reuse of Threat and Vulnerability Information
- SA-15(10) Incident Response Plan
- SA-15(11) Archive System or Component
- SA-15(12) Minimize Personally Identifiable Information
- SA-15(13) Logging Syntax
Withdrawn by NIST: SA-15(04) (now in SA-11(02)); SA-15(09) (now in SA-03(02)).
Each enhancement's statement: /api/v1/controls/SA-15?fields=enhancements

## Patterns that use it (5)
- Critical (1): SP-012 Secure Software Development Lifecycle
- Important (2): SP-028 Secure DevOps Pipeline Pattern; SP-053 Zero-Knowledge Proof Architecture (draft)
- Standard (2): SP-035 Offensive Security Testing; SP-051 Tokenised Asset Security Architecture (draft)

## Clauses by framework (48 frameworks)
- iso_27001_2022: A.5.8, A.8.25, A.8.28, A.8.30, A.8.33. OSA's own, not in NIST's crosswalk: A.8.28, A.8.33
- iso_27002_2022: 8.25, 8.28, 8.33
- cobit_2019: APO11, BAI03
- pci_dss_v4: 6.1, 6.2
- nist_csf_2: ID.RA-09, PR.PS-06
- cis_controls_v8: CIS 16, CIS 16.1
- mas_trm: 5, 6
- bio2: 8.25, 8.28, 8.33
- rbi_csf: Annex1.6, ITGRCA.12
- fisc: FISC.O10, FISC.T6
- hkma_tme1: TME1.3.1, TME1.3.2
- mlps_2: 8.1.9.4
- dnb_good_practice: DNB.10.4
- cra: CRA.I.1, CRA.I.2a
- cbb_tm: TM-7
- cbuae: CR-6
- nca_ecc: 1-6, 2-14
- qatar_nia: SD
- sama_csf: 1.4, 3.2
- uae_ia: T10
- bog_cisd: CISD-SDLC
- bom_ctrm: 3.11
- cbe_csf: CTO-4
- sa_js2: JS2-SA
- bcbs_239: Principle 6
- bot_cyber: Ch2.5, Ch6.2
- cpmi_pfmi: CG.ID, CG.TE
- eba_ict: 3.4.6, 3.6.2
- ecb_croe: CROE.2.3.4, CROE.2.6.1
- ffiec_is: II.C.17
- iosco_cyber: PROT-6
- nydfs_500: 500.5, 500.8
- sebi_cscrf: PR.AS, PR.IP
- ieee_1686: 5.10
- pci_pts: F, H
- fips_140: FIPS 140-3 §7.11
- common_criteria: CC Part 3 — SAR
- fda_21_cfr_11: §11.10(a)
- fda_cyber: SPDF-1, ST-1
- hitrust_csf: 10.b, 10.d
- iso_27799: 14.2, 14.3
- naic_ds: 4-config
- pra_ss1_23: P3.1, P3.3
- solvency_ii: EIOPA-ICT-4.11
- csa_ccm_v4: AIS-02, AIS-04
- csa_aicm: AIS-02, AIS-04, AIS-11, MDS-10
- ccss_v9: 1.02.7
- basel_sco60: SCO60.51, SCO60.52
OSA's mapping for iso_27001_2022 and nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/SA-15
- Clauses only: /api/v1/controls/SA-15?fields=mappings
- Page for people: /controls/sa-15/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.