Skip to main content

💼 SA-8 Security and Privacy Engineering Principles

  • ID: /frameworks/nist-sp-800-53-r5/sa/08

Description​

Apply the following systems security and privacy engineering principles in the specification, design, development, implementation, and modification of the system and system components: [Assignment: organization-defined systems security and privacy engineering principles].

Similar​

  • Internal
    • ID: dec-c-2a38e125

Similar Sections (Give Policies To)​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 FedRAMP High Security Controls → 💼 SA-8 Security and Privacy Engineering Principles (L)(M)(H)6no data
💼 FedRAMP Low Security Controls → 💼 SA-8 Security and Privacy Engineering Principles (L)(M)(H)6no data
💼 NIST CSF v2.0 → 💼 ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles25no data
💼 NIST CSF v2.0 → 💼 ID.IM-01: Improvements are identified from evaluations26no data
💼 NIST CSF v2.0 → 💼 ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties40no data
💼 NIST CSF v2.0 → 💼 ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities41no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected142no data
💼 NIST CSF v2.0 → 💼 PR.IR-03: Mechanisms are implemented to achieve resilience requirements in normal and adverse situations15no data

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 SA-8(1) Security and Privacy Engineering Principles _ Clear Abstractionsno data
💼 SA-8(2) Security and Privacy Engineering Principles _ Least Common Mechanismno data
💼 SA-8(3) Security and Privacy Engineering Principles _ Modularity and Layeringno data
💼 SA-8(4) Security and Privacy Engineering Principles _ Partially Ordered Dependenciesno data
💼 SA-8(5) Security and Privacy Engineering Principles _ Efficiently Mediated Accessno data
💼 SA-8(6) Security and Privacy Engineering Principles _ Minimized Sharingno data
💼 SA-8(7) Security and Privacy Engineering Principles _ Reduced Complexityno data
💼 SA-8(8) Security and Privacy Engineering Principles _ Secure Evolvabilityno data
💼 SA-8(9) Security and Privacy Engineering Principles _ Trusted Componentsno data
💼 SA-8(10) Security and Privacy Engineering Principles _ Hierarchical Trustno data
💼 SA-8(11) Security and Privacy Engineering Principles _ Inverse Modification Thresholdno data
💼 SA-8(12) Security and Privacy Engineering Principles _ Hierarchical Protectionno data
💼 SA-8(13) Security and Privacy Engineering Principles _ Minimized Security Elementsno data
💼 SA-8(14) Security and Privacy Engineering Principles _ Least Privilegeno data
💼 SA-8(15) Security and Privacy Engineering Principles _ Predicate Permissionno data
💼 SA-8(16) Security and Privacy Engineering Principles _ Self-reliant Trustworthinessno data
💼 SA-8(17) Security and Privacy Engineering Principles _ Secure Distributed Compositionno data
💼 SA-8(18) Security and Privacy Engineering Principles _ Trusted Communications Channelsno data
💼 SA-8(19) Security and Privacy Engineering Principles _ Continuous Protection1no data
💼 SA-8(20) Security and Privacy Engineering Principles _ Secure Metadata Managementno data
💼 SA-8(21) Security and Privacy Engineering Principles _ Self-analysis1no data
💼 SA-8(22) Security and Privacy Engineering Principles _ Accountability and Traceability1no data
💼 SA-8(23) Security and Privacy Engineering Principles _ Secure Defaultsno data
💼 SA-8(24) Security and Privacy Engineering Principles _ Secure Failure and Recoveryno data
💼 SA-8(25) Security and Privacy Engineering Principles _ Economic Security1no data
💼 SA-8(26) Security and Privacy Engineering Principles _ Performance Securityno data
💼 SA-8(27) Security and Privacy Engineering Principles _ Human Factored Securityno data
💼 SA-8(28) Security and Privacy Engineering Principles _ Acceptable Securityno data
💼 SA-8(29) Security and Privacy Engineering Principles _ Repeatable and Documented Proceduresno data
💼 SA-8(30) Security and Privacy Engineering Principles _ Procedural Rigorno data
💼 SA-8(31) Security and Privacy Engineering Principles _ Secure System Modificationno data
💼 SA-8(32) Security and Privacy Engineering Principles _ Sufficient Documentationno data
💼 SA-8(33) Security and Privacy Engineering Principles _ Minimizationno data

Policies (6)​

PolicyLogic CountFlagsCompliance
🛡️ Google API Key is not restricted for unused APIs🟢1🟢 x6no data
🛡️ Google API Key is not rotated every 90 days🟢1🟢 x6no data
🛡️ Google Cloud SQL Server Instance 3625 (trace flag) Database Flag is not set to on🟢1🟢 x6no data
🛡️ Google Cloud SQL Server Instance user connections Database Flag is set to a limiting (other than 0) value🟢1🟢 x6no data
🛡️ Google Cloud SQL Server Instance user options Database Flag is configured🟢1🟢 x6no data
🛡️ Google Project has API Keys🟢1🟠 x1, 🟢 x5no data