The organization requires the developer of the information system, system component, or information system service to perform a criticality analysis at [organization-defined breadth/depth] and at [organization-defined decision points in the system development life cycle].
Supplemental
This control enhancement provides developer input to the criticality analysis performed by organizations in SA-14. Developer input is essential to such analysis because organizations may not have access to detailed design documentation for information system components that are developed as commercial off-the-shelf (COTS) information technology products (e.g., functional specifications, high-level designs, low-level designs, and source code/hardware schematics).