SA — System and Services Acquisition
NIST SP 800-53 Rev. 5 Controls
145 articles
- NIST SP 800-53 Rev. 5 SA-1 — Policy And Procedures
- NIST SP 800-53 Rev. 5 SA-2 — Allocation Of Resources
- NIST SP 800-53 Rev. 5 SA-3 — System Development Life Cycle
- NIST SP 800-53 Rev. 5 SA-3(1) — Manage Preproduction Environment
- NIST SP 800-53 Rev. 5 SA-3(2) — Use Of Live Or Operational Data
- NIST SP 800-53 Rev. 5 SA-3(3) — Technology Refresh
- NIST SP 800-53 Rev. 5 SA-4 — Acquisition Process
- NIST SP 800-53 Rev. 5 SA-4(1) — Functional Properties Of Controls
- NIST SP 800-53 Rev. 5 SA-4(2) — Design And Implementation Information For Controls
- NIST SP 800-53 Rev. 5 SA-4(3) — Development Methods, Techniques, And Practices
- NIST SP 800-53 Rev. 5 SA-4(4) — Assignment Of Components To Systems
- NIST SP 800-53 Rev. 5 SA-4(5) — System, Component, And Service Configurations
- NIST SP 800-53 Rev. 5 SA-4(6) — Use Of Information Assurance Products
- NIST SP 800-53 Rev. 5 SA-4(7) — Niap-Approved Protection Profiles
- NIST SP 800-53 Rev. 5 SA-4(8) — Continuous Monitoring Plan For Controls
- NIST SP 800-53 Rev. 5 SA-4(9) — Functions, Ports, Protocols, And Services In Use
- NIST SP 800-53 Rev. 5 SA-4(10) — Use Of Approved Piv Products
- NIST SP 800-53 Rev. 5 SA-4(11) — System Of Records
- NIST SP 800-53 Rev. 5 SA-4(12) — Data Ownership
- NIST SP 800-53 Rev. 5 SA-5 — System Documentation
- NIST SP 800-53 Rev. 5 SA-5(1) — Functional Properties Of Security Controls
- NIST SP 800-53 Rev. 5 SA-5(2) — Security-Relevant External System Interfaces
- NIST SP 800-53 Rev. 5 SA-5(3) — High-Level Design
- NIST SP 800-53 Rev. 5 SA-5(4) — Low-Level Design
- NIST SP 800-53 Rev. 5 SA-5(5) — Source Code
- NIST SP 800-53 Rev. 5 SA-6 — Software Usage Restrictions
- NIST SP 800-53 Rev. 5 SA-7 — User-Installed Software
- NIST SP 800-53 Rev. 5 SA-8 — Security And Privacy Engineering Principles
- NIST SP 800-53 Rev. 5 SA-8(1) — Clear Abstractions
- NIST SP 800-53 Rev. 5 SA-8(2) — Least Common Mechanism
- NIST SP 800-53 Rev. 5 SA-8(3) — Modularity And Layering
- NIST SP 800-53 Rev. 5 SA-8(4) — Partially Ordered Dependencies
- NIST SP 800-53 Rev. 5 SA-8(5) — Efficiently Mediated Access
- NIST SP 800-53 Rev. 5 SA-8(6) — Minimized Sharing
- NIST SP 800-53 Rev. 5 SA-8(7) — Reduced Complexity
- NIST SP 800-53 Rev. 5 SA-8(8) — Secure Evolvability
- NIST SP 800-53 Rev. 5 SA-8(9) — Trusted Components
- NIST SP 800-53 Rev. 5 SA-8(10) — Hierarchical Trust
- NIST SP 800-53 Rev. 5 SA-8(11) — Inverse Modification Threshold
- NIST SP 800-53 Rev. 5 SA-8(12) — Hierarchical Protection
- NIST SP 800-53 Rev. 5 SA-8(13) — Minimized Security Elements
- NIST SP 800-53 Rev. 5 SA-8(14) — Least Privilege
- NIST SP 800-53 Rev. 5 SA-8(15) — Predicate Permission
- NIST SP 800-53 Rev. 5 SA-8(16) — Self-Reliant Trustworthiness
- NIST SP 800-53 Rev. 5 SA-8(17) — Secure Distributed Composition
- NIST SP 800-53 Rev. 5 SA-8(18) — Trusted Communications Channels
- NIST SP 800-53 Rev. 5 SA-8(19) — Continuous Protection
- NIST SP 800-53 Rev. 5 SA-8(20) — Secure Metadata Management
- NIST SP 800-53 Rev. 5 SA-8(21) — Self-Analysis
- NIST SP 800-53 Rev. 5 SA-8(22) — Accountability And Traceability
- NIST SP 800-53 Rev. 5 SA-8(23) — Secure Defaults
- NIST SP 800-53 Rev. 5 SA-8(24) — Secure Failure And Recovery
- NIST SP 800-53 Rev. 5 SA-8(25) — Economic Security
- NIST SP 800-53 Rev. 5 SA-8(26) — Performance Security
- NIST SP 800-53 Rev. 5 SA-8(27) — Human Factored Security
- NIST SP 800-53 Rev. 5 SA-8(28) — Acceptable Security
- NIST SP 800-53 Rev. 5 SA-8(29) — Repeatable And Documented Procedures
- NIST SP 800-53 Rev. 5 SA-8(30) — Procedural Rigor
- NIST SP 800-53 Rev. 5 SA-8(31) — Secure System Modification
- NIST SP 800-53 Rev. 5 SA-8(32) — Sufficient Documentation
- NIST SP 800-53 Rev. 5 SA-8(33) — Minimization
- NIST SP 800-53 Rev. 5 SA-9 — External System Services
- NIST SP 800-53 Rev. 5 SA-9(1) — Risk Assessments And Organizational Approvals
- NIST SP 800-53 Rev. 5 SA-9(2) — Identification Of Functions, Ports, Protocols, And Services
- NIST SP 800-53 Rev. 5 SA-9(3) — Establish And Maintain Trust Relationship With Providers
- NIST SP 800-53 Rev. 5 SA-9(4) — Consistent Interests Of Consumers And Providers
- NIST SP 800-53 Rev. 5 SA-9(5) — Processing, Storage, And Service Location
- NIST SP 800-53 Rev. 5 SA-9(6) — Organization-Controlled Cryptographic Keys
- NIST SP 800-53 Rev. 5 SA-9(7) — Organization-Controlled Integrity Checking
- NIST SP 800-53 Rev. 5 SA-9(8) — Processing And Storage Location -- U.S. Jurisdiction
- NIST SP 800-53 Rev. 5 SA-10 — Developer Configuration Management
- NIST SP 800-53 Rev. 5 SA-10(1) — Software And Firmware Integrity Verification
- NIST SP 800-53 Rev. 5 SA-10(2) — Alternative Configuration Management Processes
- NIST SP 800-53 Rev. 5 SA-10(3) — Hardware Integrity Verification
- NIST SP 800-53 Rev. 5 SA-10(4) — Trusted Generation
- NIST SP 800-53 Rev. 5 SA-10(5) — Mapping Integrity For Version Control
- NIST SP 800-53 Rev. 5 SA-10(6) — Trusted Distribution
- NIST SP 800-53 Rev. 5 SA-10(7) — Security And Privacy Representatives
- NIST SP 800-53 Rev. 5 SA-11 — Developer Testing And Evaluation
- NIST SP 800-53 Rev. 5 SA-11(1) — Static Code Analysis
- NIST SP 800-53 Rev. 5 SA-11(2) — Threat Modeling And Vulnerability Analyses
- NIST SP 800-53 Rev. 5 SA-11(3) — Independent Verification Of Assessment Plans And Evidence
- NIST SP 800-53 Rev. 5 SA-11(4) — Manual Code Reviews
- NIST SP 800-53 Rev. 5 SA-11(5) — Penetration Testing
- NIST SP 800-53 Rev. 5 SA-11(6) — Attack Surface Reviews
- NIST SP 800-53 Rev. 5 SA-11(7) — Verify Scope Of Testing And Evaluation
- NIST SP 800-53 Rev. 5 SA-11(8) — Dynamic Code Analysis
- NIST SP 800-53 Rev. 5 SA-11(9) — Interactive Application Security Testing
- NIST SP 800-53 Rev. 5 SA-12 — Supply Chain Protection
- NIST SP 800-53 Rev. 5 SA-12(1) — Acquisition Strategies, Tools, And Methods
- NIST SP 800-53 Rev. 5 SA-12(2) — Supplier Reviews
- NIST SP 800-53 Rev. 5 SA-12(3) — Trusted Shipping And Warehousing
- NIST SP 800-53 Rev. 5 SA-12(4) — Diversity Of Suppliers
- NIST SP 800-53 Rev. 5 SA-12(5) — Limitation Of Harm
- NIST SP 800-53 Rev. 5 SA-12(6) — Minimizing Procurement Time
- NIST SP 800-53 Rev. 5 SA-12(7) — Assessments Prior To Selection / Acceptance / Update
- NIST SP 800-53 Rev. 5 SA-12(8) — Use Of All-Source Intelligence
- NIST SP 800-53 Rev. 5 SA-12(9) — Operations Security
- NIST SP 800-53 Rev. 5 SA-12(10) — Validate As Genuine And Not Altered
- NIST SP 800-53 Rev. 5 SA-12(11) — Penetration Testing / Analysis Of Elements, Processes, And Actors
- NIST SP 800-53 Rev. 5 SA-12(12) — Inter-Organizational Agreements
- NIST SP 800-53 Rev. 5 SA-12(13) — Critical Information System Components
- NIST SP 800-53 Rev. 5 SA-12(14) — Identity And Traceability
- NIST SP 800-53 Rev. 5 SA-12(15) — Processes To Address Weaknesses Or Deficiencies
- NIST SP 800-53 Rev. 5 SA-13 — Trustworthiness
- NIST SP 800-53 Rev. 5 SA-14 — Criticality Analysis
- NIST SP 800-53 Rev. 5 SA-14(1) — Critical Components With No Viable Alternative Sourcing
- NIST SP 800-53 Rev. 5 SA-15 — Development Process, Standards, And Tools
- NIST SP 800-53 Rev. 5 SA-15(1) — Quality Metrics
- NIST SP 800-53 Rev. 5 SA-15(2) — Security And Privacy Tracking Tools
- NIST SP 800-53 Rev. 5 SA-15(3) — Criticality Analysis
- NIST SP 800-53 Rev. 5 SA-15(4) — Threat Modeling And Vulnerability Analysis
- NIST SP 800-53 Rev. 5 SA-15(5) — Attack Surface Reduction
- NIST SP 800-53 Rev. 5 SA-15(6) — Continuous Improvement
- NIST SP 800-53 Rev. 5 SA-15(7) — Automated Vulnerability Analysis
- NIST SP 800-53 Rev. 5 SA-15(8) — Reuse Of Threat And Vulnerability Information
- NIST SP 800-53 Rev. 5 SA-15(9) — Use Of Live Data
- NIST SP 800-53 Rev. 5 SA-15(10) — Incident Response Plan
- NIST SP 800-53 Rev. 5 SA-15(11) — Archive System Or Component
- NIST SP 800-53 Rev. 5 SA-15(12) — Minimize Personally Identifiable Information
- NIST SP 800-53 Rev. 5 SA-16 — Developer-Provided Training
- NIST SP 800-53 Rev. 5 SA-17 — Developer Security And Privacy Architecture And Design
- NIST SP 800-53 Rev. 5 SA-17(1) — Formal Policy Model
- NIST SP 800-53 Rev. 5 SA-17(2) — Security-Relevant Components
- NIST SP 800-53 Rev. 5 SA-17(3) — Formal Correspondence
- NIST SP 800-53 Rev. 5 SA-17(4) — Informal Correspondence
- NIST SP 800-53 Rev. 5 SA-17(5) — Conceptually Simple Design
- NIST SP 800-53 Rev. 5 SA-17(6) — Structure For Testing
- NIST SP 800-53 Rev. 5 SA-17(7) — Structure For Least Privilege
- NIST SP 800-53 Rev. 5 SA-17(8) — Orchestration
- NIST SP 800-53 Rev. 5 SA-17(9) — Design Diversity
- NIST SP 800-53 Rev. 5 SA-18 — Tamper Resistance And Detection
- NIST SP 800-53 Rev. 5 SA-18(1) — Multiple Phases Of System Development Life Cycle
- NIST SP 800-53 Rev. 5 SA-18(2) — Inspection Of Systems Or Components
- NIST SP 800-53 Rev. 5 SA-19 — Component Authenticity
- NIST SP 800-53 Rev. 5 SA-19(1) — Anti-Counterfeit Training
- NIST SP 800-53 Rev. 5 SA-19(2) — Configuration Control For Component Service And Repair
- NIST SP 800-53 Rev. 5 SA-19(3) — Component Disposal
- NIST SP 800-53 Rev. 5 SA-19(4) — Anti-Counterfeit Scanning
- NIST SP 800-53 Rev. 5 SA-20 — Customized Development Of Critical Components
- NIST SP 800-53 Rev. 5 SA-21 — Developer Screening
- NIST SP 800-53 Rev. 5 SA-21(1) — Validation Of Screening
- NIST SP 800-53 Rev. 5 SA-22 — Unsupported System Components
- NIST SP 800-53 Rev. 5 SA-22(1) — Alternative Sources For Continued Support
- NIST SP 800-53 Rev. 5 SA-23 — Specialization