Navigate

SA-15

SA-15: Development Process, Standards, And Tools

The organization:

SA-15a.: Requires the developer of the information system, system component, or information system service to follow a documented development process that:
- SA-15a.1.: Explicitly addresses security requirements;
- SA-15a.2.: Identifies the standards and tools used in the development process;
- SA-15a.3.: Documents the specific tool options and tool configurations used in the development process; and
- SA-15a.4.: Documents, manages, and ensures the integrity of changes to the process and/or tools used in development; and

SA-15b.: Reviews the development process, standards, tools, and tool options/configurations [Assignment: organization-defined frequency] to determine if the process, standards, tools, and tool options/configurations selected and employed can satisfy [Assignment: organization-defined security requirements].

Supplemental

Development tools include, for example, programming languages and computer-aided design (CAD) systems. Reviews of development processes can include, for example, the use of maturity models to determine the potential effectiveness of such processes. Maintaining the integrity of changes to tools and processes enables accurate supply chain risk assessment and mitigation, and requires robust configuration control throughout the life cycle (including design, development, transport, delivery, integration, and maintenance) to track authorized changes and prevent unauthorized changes.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to SA-15.

Control	Description
SA-3	The organization: SA-3a.: Manages the information system using [Assignment: organization-defined system development life cycle] that incorporates information security considerations; SA-3b.: Defines and documents information security roles and responsibilities throughout the system development life cycle; SA-3c.: Identifies individuals having information security roles and responsibilities; and SA-3d.: Integrates the organizational information security risk management process into system development life cycle activities.
SA-8	The organization applies information system security engineering principles in the specification, design, development, implementation, and modification of the information system.

Control

Description

SA-3

The organization:

SA-3a.: Manages the information system using [Assignment: organization-defined system development life cycle] that incorporates information security considerations;

SA-3b.: Defines and documents information security roles and responsibilities throughout the system development life cycle;

SA-3c.: Identifies individuals having information security roles and responsibilities; and

SA-3d.: Integrates the organizational information security risk management process into system development life cycle activities.

SA-8

The organization applies information system security engineering principles in the specification, design, development, implementation, and modification of the information system.

Enhancements

The controls below (if any) add on to the requirements of SA-15.

Control	Description
SA-15 (1)	The organization requires the developer of the information system, system component, or information system service to: SA-15 (1)(a): Define quality metrics at the beginning of the development process; and SA-15 (1)(b): Provide evidence of meeting the quality metrics [Selection (one or more): [Assignment: organization-defined frequency]; [Assignment: organization-defined program review milestones]; upon delivery].
SA-15 (2)	The organization requires the developer of the information system, system component, or information system service to select and employ a security tracking tool for use during the development process.
SA-15 (3)	The organization requires the developer of the information system, system component, or information system service to perform a criticality analysis at [Assignment: organization-defined breadth/depth] and at [Assignment: organization-defined decision points in the system development life cycle].
SA-15 (4)	The organization requires that developers perform threat modeling and a vulnerability analysis for the information system at [Assignment: organization-defined breadth/depth] that: SA-15 (4)(a): Uses [Assignment: organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels]; SA-15 (4)(b): Employs [Assignment: organization-defined tools and methods]; and SA-15 (4)(c): Produces evidence that meets [Assignment: organization-defined acceptance criteria].
SA-15 (5)	The organization requires the developer of the information system, system component, or information system service to reduce attack surfaces to [Assignment: organization-defined thresholds].
SA-15 (6)	The organization requires the developer of the information system, system component, or information system service to implement an explicit process to continuously improve the development process.
SA-15 (7)	The organization requires the developer of the information system, system component, or information system service to: SA-15 (7)(a): Perform an automated vulnerability analysis using [Assignment: organization-defined tools]; SA-15 (7)(b): Determine the exploitation potential for discovered vulnerabilities; SA-15 (7)(c): Determine potential risk mitigations for delivered vulnerabilities; and SA-15 (7)(d): Deliver the outputs of the tools and results of the analysis to [Assignment: organization-defined personnel or roles].
SA-15 (8)	The organization requires the developer of the information system, system component, or information system service to use threat modeling and vulnerability analyses from similar systems, components, or services to inform the current development process.
SA-15 (9)	The organization approves, documents, and controls the use of live data in development and test environments for the information system, system component, or information system service.
SA-15 (10)	The organization requires the developer of the information system, system component, or information system service to provide an incident response plan.
SA-15 (11)	The organization requires the developer of the information system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security review.

Related CCIs

The CCIs below are tied to SA-15.

CCI	Definition
CCI-003233	The organization requires the developer of the information system, system component, or information system service to follow a documented development process.
CCI-003234	The documented information system, system component, or information system service development process explicitly addresses security requirements.
CCI-003235	The documented information system, system component, or information system service development process identifies the standards used in the development process.
CCI-003236	The documented information system, system component, or information system service development process identifies the tools used in the development process.
CCI-003237	The documented information system, system component, or information system service development process documents the specific tool options and tool configurations used in the development process.
CCI-003238	The documented information system, system component, or information system service development process documents changes to the process and/or tools used in development.
CCI-003239	The documented information system, system component, or information system service development process manages changes to the process and/or tools used in development.
CCI-003240	The documented information system, system component, or information system service development process ensures the integrity of changes to the process and/or tools used in development.
CCI-003241	The organization reviews the development process in accordance with organization-defined frequency to determine if the development process selected and employed can satisfy organization-defined security requirements.
CCI-003242	The organization reviews the development standards in accordance with organization-defined frequency to determine if the development standards selected and employed can satisfy organization-defined security requirements.
CCI-003243	The organization reviews the development tools in accordance with organization-defined frequency to determine if the development tools selected and employed can satisfy organization-defined security requirements.
CCI-003244	The organization reviews the development tool options/configurations in accordance with organization-defined frequency to determine if the development tool options/configurations selected and employed can satisfy organization-defined security requirements.
CCI-003245	The organization defines the frequency on which to review the development process, standards, tools, and tool options/configurations to determine if the process, standards, tools, and tool options/configurations selected and employed can satisfy organization-defined security requirements.
CCI-003246	The organization defines the security requirements that must be satisfied by conducting a review of the development process, standards, tools, and tool options/configurations.