CyberStrikeus/CyberStrike - Page 135

sa-17-8-orchestration

Design [organization-defined] with coordinated behavior to implement the following capabilities: [organization-defined].

sa-17-9-design-diversity

Use different designs for [organization-defined] to satisfy a common set of requirements or to provide equivalent functionality.

sa-17-developer-security-and-privacy-architecture-and-design

Require the developer of the system, system component, or system service to produce a design specification and security and privacy architecture that:

sa-18-1-multiple-phases-of-system-development-life-cycle

Multiple Phases of System Development Life Cycle

sa-18-2-inspection-of-systems-or-components

Inspection of Systems or Components

sa-18-tamper-resistance-and-detection

Tamper Resistance and Detection

sa-19-1-anti-counterfeit-training

Anti-counterfeit Training

sa-19-2-configuration-control-for-component-service-and-repair

Configuration Control for Component Service and Repair

sa-19-3-component-disposal

Component Disposal

sa-19-4-anti-counterfeit-scanning

Anti-counterfeit Scanning

sa-19-component-authenticity

Component Authenticity

sa-2-allocation-of-resources

Determine the high-level information security and privacy requirements for the system or system service in mission and business process planning;

sa-20-customized-development-of-critical-components

Reimplement or custom develop the following critical system components: [organization-defined].

sa-21-1-validation-of-screening

Validation of Screening

sa-21-developer-screening

Require that the developer of [organization-defined]: Has appropriate access authorizations as determined by assigned [organization-defined] ; and Sat

sa-22-1-alternative-sources-for-continued-support

Alternative Sources for Continued Support

sa-22-unsupported-system-components

Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer;

sa-23-specialization

Employ [organization-defined] on [organization-defined] supporting mission essential services or functions to increase the trustworthiness in those sy

sa-24-design-for-cyber-resiliency

Design organizational systems, system components, or system services to achieve cyber resiliency by: Defining the following cyber resiliency goals: [o

sa-3-1-manage-preproduction-environment

Protect system preproduction environments commensurate with risk throughout the system development life cycle for the system, system component, or sys

sa-3-2-use-of-live-or-operational-data

Approve, document, and control the use of live data in preproduction environments for the system, system component, or system service;

sa-3-3-technology-refresh

Plan for and implement a technology refresh schedule for the system throughout the system development life cycle.

sa-3-system-development-life-cycle

Acquire, develop, and manage the system using [organization-defined] that incorporates information security and privacy considerations;

sa-4-1-functional-properties-of-controls

Require the developer of the system, system component, or system service to provide a description of the functional properties of the controls to be i

sa-4-10-use-of-approved-piv-products

Employ only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented wit

sa-4-11-system-of-records

Include [organization-defined] in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an orga

sa-4-12-data-ownership

Include organizational data ownership requirements in the acquisition contract;

sa-4-2-design-and-implementation-information-for-controls

Require the developer of the system, system component, or system service to provide design and implementation information for the controls that includ

sa-4-3-development-methods-techniques-and-practices

Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includ

sa-4-4-assignment-of-components-to-systems

Assignment of Components to Systems

sa-4-5-system-component-and-service-configurations

Require the developer of the system, system component, or system service to: Deliver the system, component, or service with [organization-defined] imp

sa-4-6-use-of-information-assurance-products

Employ only government off-the-shelf or commercial off-the-shelf information assurance and information assurance-enabled information technology pro...

sa-4-7-niap-approved-protection-profiles

Limit the use of commercially provided information assurance and information assurance-enabled information technology products to those products th...

sa-4-8-continuous-monitoring-plan-for-controls

Require the developer of the system, system component, or system service to produce a plan for continuous monitoring of control effectiveness that is

sa-4-9-functions-ports-protocols-and-services-in-use

Require the developer of the system, system component, or system service to identify the functions, ports, protocols, and services intended for organi

sa-4-acquisition-process

Include the following requirements, descriptions, and criteria, explicitly or by reference, using [organization-defined] in the acquisition contract f

sa-5-1-functional-properties-of-security-controls

Functional Properties of Security Controls

sa-5-2-security-relevant-external-system-interfaces

Security-relevant External System Interfaces

sa-5-3-high-level-design

High-level Design

sa-5-4-low-level-design

Low-level Design