SA-21 Developer Screening

Guidance: nonePolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
High	Organization	None

Related controls: PS-2, PS-3, PS-6, PS-7, SA-4, SR-6

Control statement

Require that the developer of [Assignment: organization-defined system, systems component, or system service]:

• a. Has appropriate access authorizations as determined by assigned [Assignment: organization-defined official government duties] ; and
• b. Satisfies the following additional personnel screening criteria: [Assignment: organization-defined additional personnel screening criteria].

NIST discussion

Developer screening is directed at external developers. Internal developer screening is addressed by PS-3 . Because the system, system component, or system service may be used in critical activities essential to the national or economic security interests of the United States, organizations have a strong interest in ensuring that developers are trustworthy. The degree of trust required of developers may need to be consistent with that of the individuals who access the systems, system components, or system services once deployed. Authorization and personnel screening criteria include clearances, background checks, citizenship, and nationality. Developer trustworthiness may also include a review and analysis of company ownership and relationships that the company has with entities that may potentially affect the quality and reliability of the systems, components, or services being developed. Satisfying the required access authorizations and personnel screening criteria includes providing a list of all individuals who are authorized to perform development activities on the selected system, system component, or system service so that organizations can validate that the developer has satisfied the authorization and screening requirements.

Withdrawn enhancements: SA-21(1).

Assessment objectives (SP 800-53A)

Objectives and methods for SA-21

Determine if:

• SA-21a. the developer of [Assignment: organization-defined system, systems component, or system service] is required to have appropriate access authorizations as determined by assigned [Assignment: organization-defined official government duties];
• SA-21b. the developer of [Assignment: organization-defined system, systems component, or system service] is required to satisfy [Assignment: organization-defined additional personnel screening criteria].

Examine: System and services acquisition policy; personnel security policy and procedures; procedures addressing personnel screening; system design documentation; acquisition documentation; service level agreements; acquisition contracts for developer services; system configuration settings and associated documentation; list of appropriate access authorizations required by the developers of the system; personnel screening criteria and associated documentation; system security plan; supply chain risk management plan; other relevant documents or records.

Interview: Organizational personnel with system and service acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel responsible for developer screening.

Test: Organizational processes for developer screening; mechanisms supporting developer screening.

Policy statement

• The System owner shall require that the developer of Fill in: the system, systems component, or system service that the developer has access to Typical: the system and any of its components where the developer has privileged access, access to source code or build systems, or access to the information the system processes has appropriate access authorizations, as determined by assigned Fill in: official government duties assigned to the developer Typical: the duties assigned to each developer’s personnel, designated at the same position risk or sensitivity level as organizational staff with equivalent access (PS-2). (SA-21a)
• The System owner shall require that the developer satisfies the following additional personnel screening criteria: Fill in: additional personnel screening criteria for the developer Typical: screening to the same criteria as organizational staff in comparable positions (PS-3), and a current list of every individual authorized to perform development work, provided before work starts and when it changes. (SA-21b)
• The System owner shall put these requirements in the development contract, and check the developer’s list of authorized individuals against the screening records before granting access. (SA-21)

From the System and Services Acquisition Policy template (draft). Highlighted fields are values your organization sets.

Artifacts

• System and Services Acquisition Decision Worksheet
• System and Services Acquisition Policy