Skip to main content

⭐ Repository → 💼 NIST SP 800-53 Revision 4

💼 SA SYSTEM AND SERVICES ACQUISITION

  • ID: /frameworks/nist-sp-800-53-r4/sa

Description​

Empty...

Similar​

  • Internal
    • ID: dec-b-edb9ba48

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 SA-1 SYSTEM AND SERVICES ACQUISITION POLICY AND PROCEDURESno data
💼 SA-2 ALLOCATION OF RESOURCESno data
💼 SA-3 SYSTEM DEVELOPMENT LIFE CYCLEno data
💼 SA-4 ACQUISITION PROCESS10no data
　💼 SA-4 (1) FUNCTIONAL PROPERTIES OF SECURITY CONTROLSno data
　💼 SA-4 (2) DESIGN _ IMPLEMENTATION INFORMATION FOR SECURITY CONTROLSno data
　💼 SA-4 (3) DEVELOPMENT METHODS _ TECHNIQUES _ PRACTICESno data
　💼 SA-4 (4) ASSIGNMENT OF COMPONENTS TO SYSTEMSno data
　💼 SA-4 (5) SYSTEM _ COMPONENT _ SERVICE CONFIGURATIONSno data
　💼 SA-4 (6) USE OF INFORMATION ASSURANCE PRODUCTSno data
　💼 SA-4 (7) NIAP-APPROVED PROTECTION PROFILESno data
　💼 SA-4 (8) CONTINUOUS MONITORING PLANno data
　💼 SA-4 (9) FUNCTIONS _ PORTS _ PROTOCOLS _ SERVICES IN USEno data
　💼 SA-4 (10) USE OF APPROVED PIV PRODUCTSno data
💼 SA-5 INFORMATION SYSTEM DOCUMENTATION5no data
　💼 SA-5 (1) FUNCTIONAL PROPERTIES OF SECURITY CONTROLSno data
　💼 SA-5 (2) SECURITY-RELEVANT EXTERNAL SYSTEM INTERFACESno data
　💼 SA-5 (3) HIGH-LEVEL DESIGNno data
　💼 SA-5 (4) LOW-LEVEL DESIGNno data
　💼 SA-5 (5) SOURCE CODEno data
💼 SA-6 SOFTWARE USAGE RESTRICTIONSno data
💼 SA-7 USER-INSTALLED SOFTWAREno data
💼 SA-8 SECURITY ENGINEERING PRINCIPLESno data
💼 SA-9 EXTERNAL INFORMATION SYSTEM SERVICES5no data
　💼 SA-9 (1) RISK ASSESSMENTS _ ORGANIZATIONAL APPROVALSno data
　💼 SA-9 (2) IDENTIFICATION OF FUNCTIONS _ PORTS _ PROTOCOLS _ SERVICESno data
　💼 SA-9 (3) ESTABLISH _ MAINTAIN TRUST RELATIONSHIP WITH PROVIDERSno data
　💼 SA-9 (4) CONSISTENT INTERESTS OF CONSUMERS AND PROVIDERSno data
　💼 SA-9 (5) PROCESSING, STORAGE, AND SERVICE LOCATIONno data
💼 SA-10 DEVELOPER CONFIGURATION MANAGEMENT6no data
　💼 SA-10 (1) SOFTWARE _ FIRMWARE INTEGRITY VERIFICATIONno data
　💼 SA-10 (2) ALTERNATIVE CONFIGURATION MANAGEMENT PROCESSESno data
　💼 SA-10 (3) HARDWARE INTEGRITY VERIFICATIONno data
　💼 SA-10 (4) TRUSTED GENERATIONno data
　💼 SA-10 (5) MAPPING INTEGRITY FOR VERSION CONTROLno data
　💼 SA-10 (6) TRUSTED DISTRIBUTIONno data
💼 SA-11 DEVELOPER SECURITY TESTING AND EVALUATION8no data
　💼 SA-11 (1) STATIC CODE ANALYSISno data
　💼 SA-11 (2) THREAT AND VULNERABILITY ANALYSESno data
　💼 SA-11 (3) INDEPENDENT VERIFICATION OF ASSESSMENT PLANS _ EVIDENCEno data
　💼 SA-11 (4) MANUAL CODE REVIEWSno data
　💼 SA-11 (5) PENETRATION TESTINGno data
　💼 SA-11 (6) ATTACK SURFACE REVIEWSno data
　💼 SA-11 (7) VERIFY SCOPE OF TESTING _ EVALUATIONno data
　💼 SA-11 (8) DYNAMIC CODE ANALYSISno data
💼 SA-12 SUPPLY CHAIN PROTECTION15no data
　💼 SA-12 (1) ACQUISITION STRATEGIES _ TOOLS _ METHODSno data
　💼 SA-12 (2) SUPPLIER REVIEWSno data
　💼 SA-12 (3) TRUSTED SHIPPING AND WAREHOUSINGno data
　💼 SA-12 (4) DIVERSITY OF SUPPLIERSno data
　💼 SA-12 (5) LIMITATION OF HARMno data
　💼 SA-12 (6) MINIMIZING PROCUREMENT TIMEno data
　💼 SA-12 (7) ASSESSMENTS PRIOR TO SELECTION _ ACCEPTANCE _ UPDATEno data
　💼 SA-12 (8) USE OF ALL-SOURCE INTELLIGENCEno data
　💼 SA-12 (9) OPERATIONS SECURITYno data
　💼 SA-12 (10) VALIDATE AS GENUINE AND NOT ALTEREDno data
　💼 SA-12 (11) PENETRATION TESTING _ ANALYSIS OF ELEMENTS, PROCESSES, AND ACTORSno data
　💼 SA-12 (12) INTER-ORGANIZATIONAL AGREEMENTSno data
　💼 SA-12 (13) CRITICAL INFORMATION SYSTEM COMPONENTSno data
　💼 SA-12 (14) IDENTITY AND TRACEABILITYno data
　💼 SA-12 (15) PROCESSES TO ADDRESS WEAKNESSES OR DEFICIENCIESno data
💼 SA-13 TRUSTWORTHINESSno data
💼 SA-14 CRITICALITY ANALYSIS1no data
　💼 SA-14 (1) CRITICAL COMPONENTS WITH NO VIABLE ALTERNATIVE SOURCINGno data
💼 SA-15 DEVELOPMENT PROCESS, STANDARDS, AND TOOLS11no data
　💼 SA-15 (1) QUALITY METRICSno data
　💼 SA-15 (2) SECURITY TRACKING TOOLSno data
　💼 SA-15 (3) CRITICALITY ANALYSISno data
　💼 SA-15 (4) THREAT MODELING _ VULNERABILITY ANALYSISno data
　💼 SA-15 (5) ATTACK SURFACE REDUCTIONno data
　💼 SA-15 (6) CONTINUOUS IMPROVEMENTno data
　💼 SA-15 (7) AUTOMATED VULNERABILITY ANALYSISno data
　💼 SA-15 (8) REUSE OF THREAT _ VULNERABILITY INFORMATIONno data
　💼 SA-15 (9) USE OF LIVE DATAno data
　💼 SA-15 (10) INCIDENT RESPONSE PLANno data
　💼 SA-15 (11) ARCHIVE INFORMATION SYSTEM _ COMPONENTno data
💼 SA-16 DEVELOPER-PROVIDED TRAININGno data
💼 SA-17 DEVELOPER SECURITY ARCHITECTURE AND DESIGN7no data
　💼 SA-17 (1) FORMAL POLICY MODELno data
　💼 SA-17 (2) SECURITY-RELEVANT COMPONENTSno data
　💼 SA-17 (3) FORMAL CORRESPONDENCEno data
　💼 SA-17 (4) INFORMAL CORRESPONDENCEno data
　💼 SA-17 (5) CONCEPTUALLY SIMPLE DESIGNno data
　💼 SA-17 (6) STRUCTURE FOR TESTINGno data
　💼 SA-17 (7) STRUCTURE FOR LEAST PRIVILEGEno data
💼 SA-18 TAMPER RESISTANCE AND DETECTION2no data
　💼 SA-18 (1) MULTIPLE PHASES OF SDLCno data
　💼 SA-18 (2) INSPECTION OF INFORMATION SYSTEMS, COMPONENTS, OR DEVICESno data
💼 SA-19 COMPONENT AUTHENTICITY4no data
　💼 SA-19 (1) ANTI-COUNTERFEIT TRAININGno data
　💼 SA-19 (2) CONFIGURATION CONTROL FOR COMPONENT SERVICE _ REPAIRno data
　💼 SA-19 (3) COMPONENT DISPOSALno data
　💼 SA-19 (4) ANTI-COUNTERFEIT SCANNINGno data
💼 SA-20 CUSTOMIZED DEVELOPMENT OF CRITICAL COMPONENTSno data
💼 SA-21 DEVELOPER SCREENING1no data
　💼 SA-21 (1) VALIDATION OF SCREENINGno data
💼 SA-22 UNSUPPORTED SYSTEM COMPONENTS1no data
　💼 SA-22 (1) ALTERNATIVE SOURCES FOR CONTINUED SUPPORTno data