| 💼 SA-1 SYSTEM AND SERVICES ACQUISITION POLICY AND PROCEDURES | | | | |
| 💼 SA-2 ALLOCATION OF RESOURCES | | | | |
| 💼 SA-3 SYSTEM DEVELOPMENT LIFE CYCLE | | | | |
| 💼 SA-4 ACQUISITION PROCESS | 10 | | | |
| 💼 SA-4 (1) FUNCTIONAL PROPERTIES OF SECURITY CONTROLS | | | | |
| 💼 SA-4 (2) DESIGN _ IMPLEMENTATION INFORMATION FOR SECURITY CONTROLS | | | | |
| 💼 SA-4 (3) DEVELOPMENT METHODS _ TECHNIQUES _ PRACTICES | | | | |
| 💼 SA-4 (4) ASSIGNMENT OF COMPONENTS TO SYSTEMS | | | | |
| 💼 SA-4 (5) SYSTEM _ COMPONENT _ SERVICE CONFIGURATIONS | | | | |
| 💼 SA-4 (6) USE OF INFORMATION ASSURANCE PRODUCTS | | | | |
| 💼 SA-4 (7) NIAP-APPROVED PROTECTION PROFILES | | | | |
| 💼 SA-4 (8) CONTINUOUS MONITORING PLAN | | | | |
| 💼 SA-4 (9) FUNCTIONS _ PORTS _ PROTOCOLS _ SERVICES IN USE | | | | |
| 💼 SA-4 (10) USE OF APPROVED PIV PRODUCTS | | | | |
| 💼 SA-5 INFORMATION SYSTEM DOCUMENTATION | 5 | | | |
| 💼 SA-5 (1) FUNCTIONAL PROPERTIES OF SECURITY CONTROLS | | | | |
| 💼 SA-5 (2) SECURITY-RELEVANT EXTERNAL SYSTEM INTERFACES | | | | |
| 💼 SA-5 (3) HIGH-LEVEL DESIGN | | | | |
| 💼 SA-5 (4) LOW-LEVEL DESIGN | | | | |
| 💼 SA-5 (5) SOURCE CODE | | | | |
| 💼 SA-6 SOFTWARE USAGE RESTRICTIONS | | | | |
| 💼 SA-7 USER-INSTALLED SOFTWARE | | | | |
| 💼 SA-8 SECURITY ENGINEERING PRINCIPLES | | | | |
| 💼 SA-9 EXTERNAL INFORMATION SYSTEM SERVICES | 5 | | | |
| 💼 SA-9 (1) RISK ASSESSMENTS _ ORGANIZATIONAL APPROVALS | | | | |
| 💼 SA-9 (2) IDENTIFICATION OF FUNCTIONS _ PORTS _ PROTOCOLS _ SERVICES | | | | |
| 💼 SA-9 (3) ESTABLISH _ MAINTAIN TRUST RELATIONSHIP WITH PROVIDERS | | | | |
| 💼 SA-9 (4) CONSISTENT INTERESTS OF CONSUMERS AND PROVIDERS | | | | |
| 💼 SA-9 (5) PROCESSING, STORAGE, AND SERVICE LOCATION | | | | |
| 💼 SA-10 DEVELOPER CONFIGURATION MANAGEMENT | 6 | | | |
| 💼 SA-10 (1) SOFTWARE _ FIRMWARE INTEGRITY VERIFICATION | | | | |
| 💼 SA-10 (2) ALTERNATIVE CONFIGURATION MANAGEMENT PROCESSES | | | | |
| 💼 SA-10 (3) HARDWARE INTEGRITY VERIFICATION | | | | |
| 💼 SA-10 (4) TRUSTED GENERATION | | | | |
| 💼 SA-10 (5) MAPPING INTEGRITY FOR VERSION CONTROL | | | | |
| 💼 SA-10 (6) TRUSTED DISTRIBUTION | | | | |
| 💼 SA-11 DEVELOPER SECURITY TESTING AND EVALUATION | 8 | | | |
| 💼 SA-11 (1) STATIC CODE ANALYSIS | | | | |
| 💼 SA-11 (2) THREAT AND VULNERABILITY ANALYSES | | | | |
| 💼 SA-11 (3) INDEPENDENT VERIFICATION OF ASSESSMENT PLANS _ EVIDENCE | | | | |
| 💼 SA-11 (4) MANUAL CODE REVIEWS | | | | |
| 💼 SA-11 (5) PENETRATION TESTING | | | | |
| 💼 SA-11 (6) ATTACK SURFACE REVIEWS | | | | |
| 💼 SA-11 (7) VERIFY SCOPE OF TESTING _ EVALUATION | | | | |
| 💼 SA-11 (8) DYNAMIC CODE ANALYSIS | | | | |
| 💼 SA-12 SUPPLY CHAIN PROTECTION | 15 | | | |
| 💼 SA-12 (1) ACQUISITION STRATEGIES _ TOOLS _ METHODS | | | | |
| 💼 SA-12 (2) SUPPLIER REVIEWS | | | | |
| 💼 SA-12 (3) TRUSTED SHIPPING AND WAREHOUSING | | | | |
| 💼 SA-12 (4) DIVERSITY OF SUPPLIERS | | | | |
| 💼 SA-12 (5) LIMITATION OF HARM | | | | |
| 💼 SA-12 (6) MINIMIZING PROCUREMENT TIME | | | | |
| 💼 SA-12 (7) ASSESSMENTS PRIOR TO SELECTION _ ACCEPTANCE _ UPDATE | | | | |
| 💼 SA-12 (8) USE OF ALL-SOURCE INTELLIGENCE | | | | |
| 💼 SA-12 (9) OPERATIONS SECURITY | | | | |
| 💼 SA-12 (10) VALIDATE AS GENUINE AND NOT ALTERED | | | | |
| 💼 SA-12 (11) PENETRATION TESTING _ ANALYSIS OF ELEMENTS, PROCESSES, AND ACTORS | | | | |
| 💼 SA-12 (12) INTER-ORGANIZATIONAL AGREEMENTS | | | | |
| 💼 SA-12 (13) CRITICAL INFORMATION SYSTEM COMPONENTS | | | | |
| 💼 SA-12 (14) IDENTITY AND TRACEABILITY | | | | |
| 💼 SA-12 (15) PROCESSES TO ADDRESS WEAKNESSES OR DEFICIENCIES | | | | |
| 💼 SA-13 TRUSTWORTHINESS | | | | |
| 💼 SA-14 CRITICALITY ANALYSIS | 1 | | | |
| 💼 SA-14 (1) CRITICAL COMPONENTS WITH NO VIABLE ALTERNATIVE SOURCING | | | | |
| 💼 SA-15 DEVELOPMENT PROCESS, STANDARDS, AND TOOLS | 11 | | | |
| 💼 SA-15 (1) QUALITY METRICS | | | | |
| 💼 SA-15 (2) SECURITY TRACKING TOOLS | | | | |
| 💼 SA-15 (3) CRITICALITY ANALYSIS | | | | |
| 💼 SA-15 (4) THREAT MODELING _ VULNERABILITY ANALYSIS | | | | |
| 💼 SA-15 (5) ATTACK SURFACE REDUCTION | | | | |
| 💼 SA-15 (6) CONTINUOUS IMPROVEMENT | | | | |
| 💼 SA-15 (7) AUTOMATED VULNERABILITY ANALYSIS | | | | |
| 💼 SA-15 (8) REUSE OF THREAT _ VULNERABILITY INFORMATION | | | | |
| 💼 SA-15 (9) USE OF LIVE DATA | | | | |
| 💼 SA-15 (10) INCIDENT RESPONSE PLAN | | | | |
| 💼 SA-15 (11) ARCHIVE INFORMATION SYSTEM _ COMPONENT | | | | |
| 💼 SA-16 DEVELOPER-PROVIDED TRAINING | | | | |
| 💼 SA-17 DEVELOPER SECURITY ARCHITECTURE AND DESIGN | 7 | | | |
| 💼 SA-17 (1) FORMAL POLICY MODEL | | | | |
| 💼 SA-17 (2) SECURITY-RELEVANT COMPONENTS | | | | |
| 💼 SA-17 (3) FORMAL CORRESPONDENCE | | | | |
| 💼 SA-17 (4) INFORMAL CORRESPONDENCE | | | | |
| 💼 SA-17 (5) CONCEPTUALLY SIMPLE DESIGN | | | | |
| 💼 SA-17 (6) STRUCTURE FOR TESTING | | | | |
| 💼 SA-17 (7) STRUCTURE FOR LEAST PRIVILEGE | | | | |
| 💼 SA-18 TAMPER RESISTANCE AND DETECTION | 2 | | | |
| 💼 SA-18 (1) MULTIPLE PHASES OF SDLC | | | | |
| 💼 SA-18 (2) INSPECTION OF INFORMATION SYSTEMS, COMPONENTS, OR DEVICES | | | | |
| 💼 SA-19 COMPONENT AUTHENTICITY | 4 | | | |
| 💼 SA-19 (1) ANTI-COUNTERFEIT TRAINING | | | | |
| 💼 SA-19 (2) CONFIGURATION CONTROL FOR COMPONENT SERVICE _ REPAIR | | | | |
| 💼 SA-19 (3) COMPONENT DISPOSAL | | | | |
| 💼 SA-19 (4) ANTI-COUNTERFEIT SCANNING | | | | |
| 💼 SA-20 CUSTOMIZED DEVELOPMENT OF CRITICAL COMPONENTS | | | | |
| 💼 SA-21 DEVELOPER SCREENING | 1 | | | |
| 💼 SA-21 (1) VALIDATION OF SCREENING | | | | |
| 💼 SA-22 UNSUPPORTED SYSTEM COMPONENTS | 1 | | | |
| 💼 SA-22 (1) ALTERNATIVE SOURCES FOR CONTINUED SUPPORT | | | | |