# SA-15 — Development Process, Standards, and Tools

- **Control ID:** SA-15
- **Family:** [SA](/md/families/SA.md)
- **Baselines:** moderate, high
- **Enhancement of:** No content available.

## Description

Require the developer of the system, system component, or system service to follow a documented development process that: Explicitly addresses security and privacy requirements; Identifies the standards and tools used in the development process; Documents the specific tool options and tool configurations used in the development process; and Documents, manages, and ensures the integrity of changes to the process and/or tools used in development; and Review the development process, standards, tools, tool options, and tool configurations \[assignment\] to determine if the process, standards, tools, tool options and tool configurations selected and employed can satisfy the following security and privacy requirements: \[assignment\].

## Discussion

Development tools include programming languages and computer-aided design systems. Reviews of development processes include the use of maturity models to determine the potential effectiveness of such processes. Maintaining the integrity of changes to tools and processes facilitates effective supply chain risk assessment and mitigation. Such integrity requires configuration control throughout the system development life cycle to track authorized changes and prevent unauthorized changes.

## Implementation guidance

No content available.

## CSF 2.0 subcategories

- [ID.RA-09](/md/csf/ID.RA-09.md) — The authenticity and integrity of hardware and software are assessed prior to acquisition and use
- [PR.PS-06](/md/csf/PR.PS-06.md) — PR.PS-06

## Related controls

- [MA-6](/md/controls/MA-6.md)
- [SA-3](/md/controls/SA-3.md)
- [SA-4](/md/controls/SA-4.md)
- [SA-8](/md/controls/SA-8.md)
- [SA-10](/md/controls/SA-10.md)
- [SA-11](/md/controls/SA-11.md)
- [SR-3](/md/controls/SR-3.md)
- [SR-4](/md/controls/SR-4.md)
- [SR-5](/md/controls/SR-5.md)
- [SR-6](/md/controls/SR-6.md)
- [SR-9](/md/controls/SR-9.md)

---

Derived from official NIST publications (NIST SP 800-53 Rev 5 and NIST CSF 2.0). nistcontrols.com is not affiliated with NIST.