Specialization
LOW MODERATE HIGHRequirements NIST SOURCE
Employ [one of: design modification; augmentation; reconfiguration] on [systems or system components] supporting mission essential services or functions to increase the trustworthiness in those systems or components.
Discussion (NIST Supplemental Guidance)
It is often necessary for a system or system component that supports mission-essential services or functions to be enhanced to maximize the trustworthiness of the resource. Sometimes this enhancement is done at the design level. In other instances, it is done post-design, either through modifications of the system in question or by augmenting the system with additional components. For example, supplemental authentication or non-repudiation functions may be added to the system to enhance the identity of critical resources to other resources that depend on the organization-defined resources.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for SA-23 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- one or more of the following PARAMETER VALUES is/are selected: {design modification; augmentation; reconfiguration};
- systems or system components supporting mission-essential services or functions are defined;
- <SA-23_ODP[01] SELECTED PARAMETER VALUES> is employed on <SA-23_ODP[02] systems or system components> supporting essential services or functions to increase the trustworthiness in those systems or components.
Examine
[SELECT FROM: System and services acquisition policy; procedures addressing design modification, augmentation, or reconfiguration of systems or system components; documented evidence of design modification, augmentation, or reconfiguration; system security plan; supply chain risk management plan; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with system and service acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel with the responsibility for security architecture; organizational personnel responsible for configuration management].
Test
[SELECT FROM: Organizational processes for the modification of design, augmentation, or reconfiguration of systems or system components; mechanisms supporting and/or implementing design modification, augmentation, or reconfiguration of systems or system components].
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for SA-23. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- System and services acquisition policy
- system security plan
- supply chain risk management plan
Testing
- Organizational processes for the modification of design, augmentation, or reconfiguration of systems or system components
- mechanisms supporting and/or implementing design modification, augmentation, or reconfiguration of systems or system components
Other Records
- procedures addressing design modification, augmentation, or reconfiguration of systems or system components
- documented evidence of design modification, augmentation, or reconfiguration
- other relevant documents or records