Navigate

SA-21

SA-21: Developer Screening

The organization requires that the developer of [organization-defined information system, system component, or information system service]:

a: Have appropriate access authorizations as determined by assigned [organization-defined official government duties]; and

b: Satisfy [organization-defined additional personnel screening criteria].

Supplemental

Because the information system, system component, or information system service may be employed in critical activities essential to the national and/or economic security interests of the United States, organizations have a strong interest in ensuring that the developer is trustworthy. The degree of trust required of the developer may need to be consistent with that of the individuals accessing the information system/component/service once deployed. Examples of authorization and personnel screening criteria include clearance, satisfactory background checks, citizenship, and nationality. Trustworthiness of developers may also include a review and analysis of company ownership and any relationships the company has with entities potentially affecting the quality/reliability of the systems, components, or services being developed.

CIA Levels
Confidentiality	high
Integrity	high
Availability	high

Overlays
Cross Domain (Access), Cross Domain (Multilevel), Cross Domain (Transfer), Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

CSF Categories
PR.IP-11

Related Controls

The controls below (if any) were marked by NIST as being related to SA-21.

Control	Description
PS-3	The organization: a: Screens individuals prior to authorizing access to the information system; and b: Rescreens individuals according to [organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of such rescreening].
PS-7	The organization: a: Establishes personnel security requirements including security roles and responsibilities for third-party providers; b: Requires third-party providers to comply with personnel security policies and procedures established by the organization; c: Documents personnel security requirements; d: Requires third-party providers to notify [organization-defined personnel or roles] of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges within [organization-defined time period]; and e: Monitors provider compliance.

Control

Description

PS-3

The organization:

a: Screens individuals prior to authorizing access to the information system; and

b: Rescreens individuals according to [organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of such rescreening].

PS-7

The organization:

a: Establishes personnel security requirements including security roles and responsibilities for third-party providers;

b: Requires third-party providers to comply with personnel security policies and procedures established by the organization;

c: Documents personnel security requirements;

d: Requires third-party providers to notify [organization-defined personnel or roles] of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges within [organization-defined time period]; and

e: Monitors provider compliance.

Enhancements

The controls below (if any) add on to the requirements of SA-21.

Control	Description
SA-21(1)	The organization requires the developer of the information system, system component, or information system service take [organization-defined actions] to ensure that the required access authorizations and screening criteria are satisfied.

Related CCIs

The CCIs below are tied to SA-21.

CCI	Definition
CCI-003381	Defines additional personnel screening criteria that must be satisfied by the developer of an organization-defined system, system component, or system service.
CCI-003382	Require that the developer of an organization-defined system, system component, or system service satisfies organization-defined additional personnel screening criteria.
CCI-003383	Defines the official government duties to be assigned to the developer of an organization-defined system, system component, or system service.
CCI-003384	Defines the system, system component, or system service which requires the system developer to have appropriate access authorizations, satisfy additional personnel screening criteria, and provide information that the access authorizations and screening criteria are satisfied.
CCI-003385	Require that the developer of an organization-defined system, system component, or system service has appropriate access authorizations as determined by assigned organization-defined official government duties.