SA-1 Policy and procedures
The system and services acquisition policy and procedures: scope, ownership, review frequency and how this -1 control governs acquisition, development and supplier controls in the SA family.
SA System and services acquisition
System and services acquisition family: SDLC, acquisition contract requirements, documentation, engineering principles, external services, developer configuration management, testing and secure development, and unsupported components.
SA-2 Allocation of resources
Allocation of resources: planning security and privacy requirements early and funding them through capital planning, with a discrete budget line item. A governance control that buyers often overlook.
SA-3 System development life cycle
The system development life cycle: choosing an SDLC that builds in security and privacy, assigning roles, and integrating risk management into each phase, plus enhancements for preproduction environments and technology refresh.
SA-4 Acquisition process
Security and privacy requirements in acquisition contracts: functional and assurance requirements, documentation, responsibilities and acceptance criteria, plus enhancements for functional properties, design information, ports and services in use, and approved PIV products.
SA-5 System documentation
System documentation: administrator and user guides for secure configuration and use, what to do when a vendor cannot supply documentation, and how documentation is distributed. All of its enhancements are withdrawn.
SA-8 Security and privacy engineering principles
Security and privacy engineering principles applied through design and development, from least privilege and defense in depth to secure defaults. It carries the largest set of enhancements in the SA family, one per principle.
SA-9 External system services
External system services: security and privacy requirements for cloud and other service providers, oversight roles, ongoing compliance monitoring, and FedRAMP's data location parameter for SA-9(5).
SA-10 Developer configuration management
Developer configuration management: change control, integrity of configuration items and flaw tracking imposed on the developer (internal or external), with enhancements for software and firmware integrity verification.
SA-11 Developer testing and evaluation
Developer testing and evaluation: assessment plans, unit, integration, system and regression testing, evidence of results and flaw remediation, with enhancements for static and dynamic analysis, threat modeling and penetration testing.
SA-15 Development process, standards, and tools
Development process, standards and tools: documented secure development processes, tool configuration control and periodic review, plus enhancements such as criticality analysis, attack surface reduction and the logging syntax enhancement added in Release 5.2.0.
SA-16 Developer-provided training
Developer-provided training on the security and privacy functions the developer built, so that administrators and users operate them correctly. Selected only in the high baseline.
SA-17 Developer security and privacy architecture and design
Developer security and privacy architecture and design: design specifications that match the enterprise architecture and allocate controls to components, with enhancements for formal policy models and structure for testing. High baseline only.
SA-20 Customized development of critical components
Customized development of critical components: re-implementing or custom building critical components when no viable controls can make an existing component trustworthy enough. Not in any SP 800-53B baseline.
SA-21 Developer screening
Developer screening: access authorizations and additional personnel screening for developers of sensitive systems and components. Selected only in the high baseline.
SA-22 Unsupported system components
Unsupported system components: identifying end-of-life hardware, software and firmware, replacing it or arranging alternative support, and documenting the risk decision. In all three security baselines.
SA-23 Specialization
Specialization: modifying, augmenting or reconfiguring components that support mission essential functions to make them more trustworthy than general-purpose products. Not in any SP 800-53B baseline.
SA-24 Design for cyber resiliency
Design for cyber resiliency: defining resiliency goals, objectives, techniques and design principles and building them into systems so essential functions continue through adversity, are restored and adapt. New in Release 5.2.0 and not in any baseline.
