Navigate

SA-4 (3)

SA-4 (3): Development Methods / Techniques / Practices

The organization requires the developer of the information system, system component, or information system service to demonstrate the use of a system development life cycle that includes [Assignment: organization-defined state-of-the-practice system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes].

Supplemental

Following a well-defined system development life cycle that includes state-of-the-practice software development methods, systems/security engineering methods, quality control processes, and testing, evaluation, and validation techniques helps to reduce the number and severity of latent errors within information systems, system components, and information system services. Reducing the number/severity of such errors reduces the number of vulnerabilities in those systems, components, and services.

CIA Levels
Confidentiality	unknown
Integrity	high
Availability	unknown

Overlays
Space Platform

Related Controls

The controls below (if any) were marked by NIST as being related to SA-4 (3).

Control	Description
SA-12	The organization protects against supply chain threats to the information system, system component, or information system service by employing [Assignment: organization-defined security safeguards] as part of a comprehensive, defense-in-breadth information security strategy.

Enhancements

The controls below (if any) add on to the requirements of SA-4 (3).

Control	Description
No controls

Related CCIs

The CCIs below are tied to SA-4 (3).

CCI	Definition
CCI-003107	The organization requires the developer of the information system, system component, or information system service to demonstrate the use of a system development life cycle that includes organization-defined state-of-the-practice system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes.
CCI-003108	The organization defines the state-of-the-practice system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes that the developer of the information system, system component, or information system service is required to include when demonstrating the use of a system development life cycle.