SA-21 SA · System and Services Acquisition

Developer Screening

LOW MODERATE ✓ HIGH
1 Overlay 6 Related Controls
Graph
Export ▾

Requirements NIST SOURCE

Require that the developer of [system, systems component, or system service]:

Discussion (NIST Supplemental Guidance)

Developer screening is directed at external developers. Internal developer screening is addressed by PS-3 . Because the system, system component, or system service may be used in critical activities essential to the national or economic security interests of the United States, organizations have a strong interest in ensuring that developers are trustworthy. The degree of trust required of developers may need to be consistent with that of the individuals who access the systems, system components, or system services once deployed. Authorization and personnel screening criteria include clearances, background checks, citizenship, and nationality. Developer trustworthiness may also include a review and analysis of company ownership and relationships that the company has with entities that may potentially affect the quality and reliability of the systems, components, or services being developed. Satisfying the required access authorizations and personnel screening criteria includes providing a list of all individuals who are authorized to perform development activities on the selected system, system component, or system service so that organizations can validate that the developer has satisfied the authorization and screening requirements.

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for SA-21 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

  1. the system, systems component, or system service that the developer has access to is/are defined;
  2. official government duties assigned to the developer are defined;
  3. additional personnel screening criteria for the developer are defined;
  4. the developer of <SA-21_ODP[01] system, systems component, or system service> is required to have appropriate access authorizations as determined by assigned <SA-21_ODP[02] official government duties>;
  5. the developer of <SA-21_ODP[01] system, systems component, or system service> is required to satisfy <SA-21_ODP[03] additional personnel screening criteria>.

Examine

[SELECT FROM: System and services acquisition policy; personnel security policy and procedures; procedures addressing personnel screening; system design documentation; acquisition documentation; service level agreements; acquisition contracts for developer services; system configuration settings and associated documentation; list of appropriate access authorizations required by the developers of the system; personnel screening criteria and associated documentation; system security plan; supply chain risk management plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with system and service acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel responsible for developer screening].

Test

[SELECT FROM: Organizational processes for developer screening; mechanisms supporting developer screening].

Overlays

OT/ICS Overlay SP 800-82r3

NIST SP 800-82r3 Appendix F, Table 22. Blank baseline means the control/control enhancement is not selected in that initial OT baseline.

LOW

Not applicable at this tier.

MODERATE

Not applicable at this tier.

HIGH

  • Base control: Included (matches standard baseline)

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for SA-21. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

  • System and services acquisition policy
  • personnel security policy and procedures
  • system security plan
  • supply chain risk management plan

Configuration

  • system design documentation
  • system configuration settings and associated documentation

Testing

  • Organizational processes for developer screening
  • mechanisms supporting developer screening

Other Records

  • procedures addressing personnel screening
  • acquisition documentation
  • service level agreements
  • acquisition contracts for developer services
  • list of appropriate access authorizations required by the developers of the system
  • personnel screening criteria and associated documentation
  • other relevant documents or records