Navigate

SA-21

SA-21: Developer Screening

Require that the developer of [the system, systems component, or system service that the developer has access to is/are defined;]:

a: Has appropriate access authorizations as determined by assigned [official government duties assigned to the developer are defined;] ; and

b: Satisfies the following additional personnel screening criteria: [additional personnel screening criteria for the developer are defined;].

Supplemental

Developer screening is directed at external developers. Internal developer screening is addressed by [PS-3](#ps-3) . Because the system, system component, or system service may be used in critical activities essential to the national or economic security interests of the United States, organizations have a strong interest in ensuring that developers are trustworthy. The degree of trust required of developers may need to be consistent with that of the individuals who access the systems, system components, or system services once deployed. Authorization and personnel screening criteria include clearances, background checks, citizenship, and nationality. Developer trustworthiness may also include a review and analysis of company ownership and relationships that the company has with entities that may potentially affect the quality and reliability of the systems, components, or services being developed. Satisfying the required access authorizations and personnel screening criteria includes providing a list of all individuals who are authorized to perform development activities on the selected system, system component, or system service so that organizations can validate that the developer has satisfied the authorization and screening requirements.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
DAF Baseline, Privacy (high), Privacy (low), Privacy (moderate)

CSF Categories
PR.IP-11

Related Controls

The controls below (if any) were marked by NIST as being related to SA-21.

Control	Description
PS-2	a: Assign a risk designation to all organizational positions; b: Establish screening criteria for individuals filling those positions; and c: Review and update position risk designations [the frequency at which to review and update position risk designations is defined;].
PS-3	a: Screen individuals prior to authorizing access to the system; and b: Rescreen individuals in accordance with [one of ].
PS-6	a: Develop and document access agreements for organizational systems; b: Review and update the access agreements [the frequency at which to review and update access agreements is defined;] ; and c: Verify that individuals requiring access to organizational information and systems: 1: Sign appropriate access agreements prior to being granted access; and 2: Re-sign access agreements to maintain access to organizational systems when access agreements have been updated or [the frequency at which to re-sign access agreements to maintain access to organizational information is defined;].
PS-7	a: Establish personnel security requirements, including security roles and responsibilities for external providers; b: Require external providers to comply with personnel security policies and procedures established by the organization; c: Document personnel security requirements; d: Require external providers to notify [personnel or roles to be notified of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges is/are defined;] of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges, or who have system privileges within [time period within which third-party providers are required to notify organization-defined personnel or roles of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges is defined;] ; and e: Monitor provider compliance with personnel security requirements.
SA-4	Include the following requirements, descriptions, and criteria, explicitly or by reference, using [one or more of "standardized contract language"/"{{ insert: param, sa-04_odp.02 }} "] in the acquisition contract for the system, system component, or system service: a: Security and privacy functional requirements; b: Strength of mechanism requirements; c: Security and privacy assurance requirements; d: Controls needed to satisfy the security and privacy requirements. e: Security and privacy documentation requirements; f: Requirements for protecting security and privacy documentation; g: Description of the system development environment and environment in which the system is intended to operate; h: Allocation of responsibility or identification of parties responsible for information security, privacy, and supply chain risk management; and i: Acceptance criteria.
SR-6	Assess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide [the frequency at which to assess and review the supply chain-related risks associated with suppliers or contractors and the systems, system components, or system services they provide is defined;].

Enhancements

The controls below (if any) add on to the requirements of SA-21.

Control	Description
SA-21(1)

Related CCIs

The CCIs below are tied to SA-21.

CCI	Definition
CCI-003381	Defines additional personnel screening criteria that must be satisfied by the developer of an organization-defined system, system component, or system service.
CCI-003382	Require that the developer of an organization-defined system, system component, or system service satisfies organization-defined additional personnel screening criteria.
CCI-003383	Defines the official government duties to be assigned to the developer of an organization-defined system, system component, or system service.
CCI-003384	Defines the system, system component, or system service which requires the system developer to have appropriate access authorizations, satisfy additional personnel screening criteria, and provide information that the access authorizations and screening criteria are satisfied.
CCI-003385	Require that the developer of an organization-defined system, system component, or system service has appropriate access authorizations as determined by assigned organization-defined official government duties.