Control Family
SA — System and Services Acquisition
24 controls · 123 enhancements
SA-1
Policy and Procedures
✓ LOW ✓ MODERATE ✓ HIGH SA-2
Allocation of Resources
✓ LOW ✓ MODERATE ✓ HIGH SA-3
System Development Life Cycle
✓ LOW ✓ MODERATE ✓ HIGH SA-4
Acquisition Process
✓ LOW ✓ MODERATE ✓ HIGH SA-5
System Documentation
✓ LOW ✓ MODERATE ✓ HIGH SA-8
Security and Privacy Engineering Principles
✓ LOW ✓ MODERATE ✓ HIGH SA-9
External System Services
✓ LOW ✓ MODERATE ✓ HIGH SA-10
Developer Configuration Management
LOW ✓ MODERATE ✓ HIGH SA-11
Developer Testing and Evaluation
LOW ✓ MODERATE ✓ HIGH SA-15
Development Process, Standards, and Tools
LOW ✓ MODERATE ✓ HIGH SA-16
Developer-provided Training
LOW MODERATE ✓ HIGH SA-17
Developer Security and Privacy Architecture and Design
LOW MODERATE ✓ HIGH SA-20
Customized Development of Critical Components
LOW MODERATE HIGH SA-21
Developer Screening
LOW MODERATE ✓ HIGH SA-22
Unsupported System Components
✓ LOW ✓ MODERATE ✓ HIGH SA-23
Specialization
LOW MODERATE HIGH SA-24