---

id: "SA-15" title: "Development Process, Standards, and Tools" family: "SA" family_name: "System and Services Acquisition" sort_id: "sa-15" priority: "P1" implementation_level: "organization" enhancements: - sa-15.1 - sa-15.2 - sa-15.3 - sa-15.4 - sa-15.5 - sa-15.6 - sa-15.7 - sa-15.8 - sa-15.9 - sa-15.10 - sa-15.11 - sa-15.12 - sa-15.13

---

Require the developer of the system, system component, or system service to follow a documented development process that:

Explicitly addresses security and privacy requirements;

Identifies the standards and tools used in the development process;

Documents the specific tool options and tool configurations used in the development process; and

Documents, manages, and ensures the integrity of changes to the process and/or tools used in development; and

Review the development process, standards, tools, tool options, and tool configurations {{ insert: param, sa-15_odp.01 }} to determine if the process, standards, tools, tool options and tool configurations selected and employed can satisfy the following security and privacy requirements: {{ insert: param, sa-15_prm_2 }}.

Guidance

Development tools include programming languages and computer-aided design systems. Reviews of development processes include the use of maturity models to determine the potential effectiveness of such processes. Maintaining the integrity of changes to tools and processes facilitates effective supply chain risk assessment and mitigation. Such integrity requires configuration control throughout the system development life cycle to track authorized changes and prevent unauthorized changes.

Assessment Objective: the developer of the system, system component, or system service is required to follow a documented development process that explicitly addresses security requirements;

Assessment Objective: the developer of the system, system component, or system service is required to follow a documented development process that explicitly addresses privacy requirements;

Assessment Objective: the developer of the system, system component, or system service is required to follow a documented development process that identifies the standards used in the development process;

Assessment Objective: the developer of the system, system component, or system service is required to follow a documented development process that identifies the tools used in the development process;

Assessment Objective: the developer of the system, system component, or system service is required to follow a documented development process that documents the specific tool used in the development process;

Assessment Objective: the developer of the system, system component, or system service is required to follow a documented development process that documents the specific tool configurations used in the development process;

Assessment Objective: the developer of the system, system component, or system service is required to follow a documented development process that documents, manages, and ensures the integrity of changes to the process and/or tools used in development;

Assessment Objective: the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed {{ insert: param, sa-15_odp.01 }} to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy {{ insert: param, sa-15_odp.02 }};

Assessment Objective: the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed {{ insert: param, sa-15_odp.01 }} to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy {{ insert: param, sa-15_odp.03 }}.

System and services acquisition policy

system and services acquisition procedures

procedures addressing development process, standards, and tools

procedures addressing the integration of security and privacy requirements during the development process

solicitation documentation

acquisition documentation

critical component inventory documentation

service level agreements

acquisition contracts for the system, system component, or system service

system developer documentation listing tool options/configuration guides

configuration management policy

configuration management records

documentation of development process reviews using maturity models

change control records

configuration control records

documented reviews of the development process, standards, tools, and tool options/configurations

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security and privacy responsibilities

system developer