# SA-20 — Customized Development of Critical Components

- **Control ID:** SA-20
- **Family:** [SA](/md/families/SA.md)
- **Baselines:** No content available.
- **Enhancement of:** No content available.

## Description

Reimplement or custom develop the following critical system components: \[assignment\].

## Discussion

Organizations determine that certain system components likely cannot be trusted due to specific threats to and vulnerabilities in those components for which there are no viable security controls to adequately mitigate risk. Reimplementation or custom development of such components may satisfy requirements for higher assurance and is carried out by initiating changes to system components (including hardware, software, and firmware) such that the standard attacks by adversaries are less likely to succeed. In situations where no alternative sourcing is available and organizations choose not to reimplement or custom develop critical system components, additional controls can be employed. Controls include enhanced auditing, restrictions on source code and system utility access, and protection from deletion of system and application files.

## Implementation guidance

No content available.

## CSF 2.0 subcategories

No content available.

## Related controls

- [CP-2](/md/controls/CP-2.md)
- [RA-9](/md/controls/RA-9.md)
- [SA-8](/md/controls/SA-8.md)

---

Derived from official NIST publications (NIST SP 800-53 Rev 5 and NIST CSF 2.0). nistcontrols.com is not affiliated with NIST.