SA-15 Development Process, Standards, and Tools
System and Services Acquisition
Description
a. Require the developer of the system, system component, or system service to follow a documented development process that: 1. Explicitly addresses security and privacy requirements; 2. Identifies the standards and tools used in the development process; 3. Documents the specific tool options and tool configurations used in the development process; and 4. Documents, manages, and ensures the integrity of changes to the process and/or tools used in development; and b. Review the development process, standards, tools, tool options, and tool configurations [Assignment: organization-defined frequency] to determine if the process, standards, tools, tool options and tool configurations selected and employed can satisfy the following security and privacy requirements: [Assignment: organization-defined security and privacy requirements].
Supplemental Guidance
Development tools include programming languages and computer-aided design systems. Reviews of development processes include the use of maturity models to determine the potential effectiveness of such processes. Maintaining the integrity of changes to tools and processes facilitates effective supply chain risk assessment and mitigation. Such integrity requires configuration control throughout the system development life cycle to track authorized changes and prevent unauthorized changes.
Changes from Rev 4
No significant changes from Rev 4.
Enhancements (11)
What NIST adds to this control. Select one to read its statement.
SA-15(01) Quality Metrics
Require the developer of the system, system component, or system service to: a. Define quality metrics at the beginning of the development process; and b. Provide evidence of meeting the quality metrics [Selection (one or more): [Assignment: organization-defined frequency]; [Assignment: organization-defined program review milestones]; upon delivery].
SA-15(02) Security and Privacy Tracking Tools
Require the developer of the system, system component, or system service to select and employ security and privacy tracking tools for use during the development process.
SA-15(03) Criticality Analysis ModerateHigh
Require the developer of the system, system component, or system service to perform a criticality analysis: a. At the following decision points in the system development life cycle: [Assignment: organization-defined decision points in the system development life cycle]; and b. At the following level of rigor: [Assignment: organization-defined breadth and depth of criticality analysis].
SA-15(05) Attack Surface Reduction
Require the developer of the system, system component, or system service to reduce attack surfaces to [Assignment: organization-defined thresholds].
SA-15(06) Continuous Improvement
Require the developer of the system, system component, or system service to implement an explicit process to continuously improve the development process.
SA-15(07) Automated Vulnerability Analysis
Require the developer of the system, system component, or system service [Assignment: organization-defined frequency] to: a. Perform an automated vulnerability analysis using [Assignment: organization-defined tools]; b. Determine the exploitation potential for discovered vulnerabilities; c. Determine potential risk mitigations for delivered vulnerabilities; and d. Deliver the outputs of the tools and results of the analysis to [Assignment: organization-defined personnel or roles].
SA-15(08) Reuse of Threat and Vulnerability Information
Require the developer of the system, system component, or system service to use threat modeling and vulnerability analyses from similar systems, components, or services to inform the current development process.
SA-15(10) Incident Response Plan
Require the developer of the system, system component, or system service to provide, implement, and test an incident response plan.
SA-15(11) Archive System or Component
Require the developer of the system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security and privacy review.
SA-15(12) Minimize Personally Identifiable Information
Require the developer of the system or system component to minimize the use of personally identifiable information in development and test environments.
SA-15(13) Logging Syntax
Require the developer of the system, system component, or system service to use [Assignment: organization-defined secure logging format] to log [assignment: organization-defined event types] at [assignment: organization-defined level of detail].
Patterns that use this control (5)
Grouped by the emphasis each pattern gives it.
MITRE ATT&CK Techniques (14)
ATT&CK v16.1Techniques mitigated by this control, mapped via CTID.