Navigate

SA-21

SA-21: Developer Screening

The organization requires that the developer of [Assignment: organization-defined information system, system component, or information system service]:

SA-21a.: Have appropriate access authorizations as determined by assigned [Assignment: organization-defined official government duties]; and

SA-21b.: Satisfy [Assignment: organization-defined additional personnel screening criteria].

Supplemental

Because the information system, system component, or information system service may be employed in critical activities essential to the national and/or economic security interests of the United States, organizations have a strong interest in ensuring that the developer is trustworthy. The degree of trust required of the developer may need to be consistent with that of the individuals accessing the information system/component/service once deployed. Examples of authorization and personnel screening criteria include clearance, satisfactory background checks, citizenship, and nationality. Trustworthiness of developers may also include a review and analysis of company ownership and any relationships the company has with entities potentially affecting the quality/reliability of the systems, components, or services being developed.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
Cross Domain (Access), Cross Domain (Multilevel), Cross Domain (Transfer), Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

Related Controls

The controls below (if any) were marked by NIST as being related to SA-21.

Control	Description
PS-3	The organization: PS-3a.: Screens individuals prior to authorizing access to the information system; and PS-3b.: Rescreens individuals according to [Assignment: organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of such rescreening].
PS-7	The organization: PS-7a.: Establishes personnel security requirements including security roles and responsibilities for third-party providers; PS-7b.: Requires third-party providers to comply with personnel security policies and procedures established by the organization; PS-7c.: Documents personnel security requirements; PS-7d.: Requires third-party providers to notify [Assignment: organization-defined personnel or roles] of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges within [Assignment: organization-defined time period]; and PS-7e.: Monitors provider compliance.

Control

Description

PS-3

The organization:

PS-3a.: Screens individuals prior to authorizing access to the information system; and

PS-3b.: Rescreens individuals according to [Assignment: organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of such rescreening].

PS-7

The organization:

PS-7a.: Establishes personnel security requirements including security roles and responsibilities for third-party providers;

PS-7b.: Requires third-party providers to comply with personnel security policies and procedures established by the organization;

PS-7c.: Documents personnel security requirements;

PS-7d.: Requires third-party providers to notify [Assignment: organization-defined personnel or roles] of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges within [Assignment: organization-defined time period]; and

PS-7e.: Monitors provider compliance.

Enhancements

The controls below (if any) add on to the requirements of SA-21.

Control	Description
SA-21 (1)	The organization requires the developer of the information system, system component, or information system service take [Assignment: organization-defined actions] to ensure that the required access authorizations and screening criteria are satisfied.

Related CCIs

The CCIs below are tied to SA-21.

CCI	Definition
CCI-003381	The organization defines additional personnel screening criteria that must be satisfied by the developer of an organization-defined information system, system component, or information system service.
CCI-003382	The organization requires that the developer of an organization-defined information system, system component, or information system service satisfy organization-defined additional personnel screening criteria.
CCI-003383	The organization defines the official government duties to be assigned to the developer of an organization-defined information system, system component, or information system service.
CCI-003384	The organization defines the information system, system component, or information system service which requires the information system developer to have appropriate access authorizations and satisfy additional personnel screening criteria.
CCI-003385	The organization requires that the developer of an organization-defined information system, system component, or information system service have appropriate access authorizations as determined by assigned organization-defined official government duties.