Navigate

SA-15(3)

SA-15(3): Criticality Analysis

The organization requires the developer of the information system, system component, or information system service to perform a criticality analysis at [one of ] and at [one of ].

Supplemental

This control enhancement provides developer input to the criticality analysis performed by organizations in SA-14. Developer input is essential to such analysis because organizations may not have access to detailed design documentation for information system components that are developed as commercial off-the-shelf (COTS) information technology products (e.g., functional specifications, high-level designs, low-level designs, and source code/hardware schematics).

CIA Levels
Confidentiality	high
Integrity	high
Availability	high

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to SA-15(3).

Control	Description
SA-4	The organization includes the following requirements, descriptions, and criteria, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs: a: Security functional requirements; b: Security strength requirements; c: Security assurance requirements; d: Security-related documentation requirements; e: Requirements for protecting security-related documentation; f: Description of the information system development environment and environment in which the system is intended to operate; and g: Acceptance criteria.
SA-14	The organization identifies critical information system components and functions by performing a criticality analysis for [one of ] at [one of ].

Control

Description

SA-4

The organization includes the following requirements, descriptions, and criteria, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs:

a: Security functional requirements;

b: Security strength requirements;

c: Security assurance requirements;

d: Security-related documentation requirements;

e: Requirements for protecting security-related documentation;

f: Description of the information system development environment and environment in which the system is intended to operate; and

g: Acceptance criteria.

SA-14

The organization identifies critical information system components and functions by performing a criticality analysis for [one of ] at [one of ].

Enhancements

The controls below (if any) add on to the requirements of SA-15(3).

Control	Description
No controls

Related CCIs

The CCIs below are tied to SA-15(3).

CCI	Definition
CCI-003253	The organization requires the developer of the information system, system component, or information system service to perform a criticality analysis at an organization-defined breadth/depth and at organization-defined decision points in the system development life cycle.
CCI-003254	Defines the breadth/depth of criticality analysis at which the developer of the system, system component, or system service is required to perform a criticality analysis.
CCI-003255	Defines decision points in the system development life cycle at which the developer of the system, system component, or system service is required to perform a criticality analysis.