SA-17—Developer Security and Privacy Architecture and Design

IL4 High

IL5

IL6

>Control Description

Require the developer of the system, system component, or system service to produce a design specification and security and privacy architecture that: a. Is consistent with the organization's security and privacy architecture that is an integral part the organization's enterprise architecture; b. Accurately and completely describes the required security and privacy functionality, and the allocation of controls among physical and logical components; and c. Expresses how individual security and privacy functions, mechanisms, and services work together to provide required security and privacy capabilities and a unified approach to protection.

>DoD Impact Level Requirements

No specific parameter values or requirements for this impact level.

>Discussion

Developer security and privacy architecture and design are directed at external developers, although they could also be applied to internal (in-house) development. In contrast, PL-8 is directed at internal developers to ensure that organizations develop a security and privacy architecture that is integrated with the enterprise architecture. The distinction between SA-17 and PL-8 is especially important when organizations outsource the development of systems, system components, or system services and when there is a requirement to demonstrate consistency with the enterprise architecture and security and privacy architecture of the organization.

ISO 15408-2, ISO 15408-3, and SP 800-160-1 provide information on security architecture and design, including formal policy models, security-relevant components, formal and informal correspondence, conceptually simple design, and structuring for least privilege and testing.

>Related Controls

>Assessment Interview Topics

Questions assessors commonly ask

Process & Governance:

•What acquisition policies and procedures address the requirements of SA-17?
•How are security and privacy requirements integrated into the acquisition process?
•Who is responsible for ensuring that acquisitions comply with SA-17?
•How is security integrated throughout your system development lifecycle (SDLC)?

Technical Implementation:

•How are security requirements defined and documented in acquisition contracts?
•What mechanisms ensure that acquired systems and services meet security requirements?
•How do you validate that vendors and service providers comply with specified security controls?
•What security practices are required at each phase of the SDLC?
•What secure coding practices and standards are required for developers?

Evidence & Documentation:

•Can you provide examples of acquisition documentation that includes security requirements?
•What evidence demonstrates that acquired systems meet security specifications?
•Where is acquisition security documentation maintained throughout the system lifecycle?
•Can you show evidence of security activities performed during development?
•Can you provide code review or static analysis results?

Ask AI

Configure your API key to use AI features.