Detections
Analytics
800-53|SA-17
Title
DEVELOPER SECURITY ARCHITECTURE AND DESIGNDescription
The organization requires the developer of the information system, system component, or information system service to produce a design specification and security architecture that:Supplemental
This control is primarily directed at external developers, although it could also be used for internal (in-house) development. In contrast, PL-8 is primarily directed at internal developers to help ensure that organizations develop an information security architecture and such security architecture is integrated or tightly coupled to the enterprise architecture. This distinction is important if/when organizations outsource the development of information systems, information system components, or information system services to external entities, and there is a requirement to demonstrate consistency with the organization's enterprise architecture and information security architecture.Reference Item Details
Reference: NIST 800-53 - Security and Privacy Controls for Federal Information Systems and Organizations
Related: PL-8,PM-7,SA-3,SA-8
Category: SYSTEM AND SERVICES ACQUISITION
Family: SYSTEM AND SERVICES ACQUISITION
Priority: P1
Baseline Impact: HIGH
Audit Items
View all Reference Audit Items