Static Code Analysis
LOW MODERATE HIGHRequirements NIST SOURCE
Require the developer of the system, system component, or system service to employ static code analysis tools to identify common flaws and document the results of the analysis.
Discussion (NIST Supplemental Guidance)
Static code analysis provides a technology and methodology for security reviews and includes checking for weaknesses in the code as well as for the incorporation of libraries or other included code with known vulnerabilities or that are out-of-date and not supported. Static code analysis can be used to identify vulnerabilities and enforce secure coding practices. It is most effective when used early in the development process, when each code change can automatically be scanned for potential weaknesses. Static code analysis can provide clear remediation guidance and identify defects for developers to fix. Evidence of the correct implementation of static analysis can include aggregate defect density for critical defect types, evidence that defects were inspected by developers or security professionals, and evidence that defects were remediated. A high density of ignored findings, commonly referred to as false positives, indicates a potential problem with the analysis process or the analysis tool. In such cases, organizations weigh the validity of the evidence against evidence from other sources.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for SA-11(1) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- the developer of the system, system component, or system service is required to employ static code analysis tools to identify common flaws;
- the developer of the system, system component, or system service is required to employ static code analysis tools to document the results of the analysis.
Examine
[SELECT FROM: System and services acquisition policy; system and services acquisition procedures; procedures addressing system developer security testing; procedures addressing flaw remediation; solicitation documentation; acquisition documentation; service level agreements; acquisition contracts for the system, system component, or system service; security and privacy architecture; system design documentation; system developer security and privacy assessment plans; results of system developer security and privacy assessments; security flaw and remediation tracking records; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with system and service acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel with developer security and privacy testing responsibilities; organizational personnel with configuration management responsibilities; system developers].
Test
[SELECT FROM: Organizational processes for monitoring developer security testing and evaluation; mechanisms supporting and/or implementing the monitoring of developer security testing and evaluation; static code analysis tools].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for SA-11(1). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- System and services acquisition policy
- system security plan
- privacy plan
Configuration
- security and privacy architecture
- system design documentation
Testing
- Organizational processes for monitoring developer security testing and evaluation
- mechanisms supporting and/or implementing the monitoring of developer security testing and evaluation
- static code analysis tools
Other Records
- system and services acquisition procedures
- procedures addressing system developer security testing
- procedures addressing flaw remediation
- solicitation documentation
- acquisition documentation
- service level agreements
- acquisition contracts for the system, system component, or system service
- system developer security and privacy assessment plans
- results of system developer security and privacy assessments
- security flaw and remediation tracking records
- privacy impact assessment
- privacy risk assessment documentation
- other relevant documents or records