System and Services Acquisition (SA)
The System and Services Acquisition family has 17 active controls in SP 800-53 release 5.2.0. “Yes” marks membership in the SP 800-53B baselines.
| Control | Title | Low | Moderate | High | Privacy |
|---|---|---|---|---|---|
| SA-1 | Policy and Procedures | Yes | Yes | Yes | Yes |
| SA-2 | Allocation of Resources | Yes | Yes | Yes | Yes |
| SA-3 | System Development Life Cycle | Yes | Yes | Yes | Yes |
| SA-4 | Acquisition Process | Yes | Yes | Yes | Yes |
| SA-5 | System Documentation | Yes | Yes | Yes | |
| SA-8 | Security and Privacy Engineering Principles | Yes | Yes | Yes | |
| SA-9 | External System Services | Yes | Yes | Yes | Yes |
| SA-10 | Developer Configuration Management | Yes | Yes | ||
| SA-11 | Developer Testing and Evaluation | Yes | Yes | Yes | |
| SA-15 | Development Process, Standards, and Tools | Yes | Yes | ||
| SA-16 | Developer-provided Training | Yes | |||
| SA-17 | Developer Security and Privacy Architecture and Design | Yes | |||
| SA-20 | Customized Development of Critical Components | ||||
| SA-21 | Developer Screening | Yes | |||
| SA-22 | Unsupported System Components | Yes | Yes | Yes | |
| SA-23 | Specialization | ||||
| SA-24 | Design For Cyber Resiliency |
Withdrawn controls: SA-6, SA-7, SA-12, SA-13, SA-14, SA-18, SA-19.
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.