SA-3 System development life cycle
What the standard requires
a. Acquire, develop, and manage the system using [system-development life cycle] that incorporates information security and privacy considerations; b. Define and document information security and privacy roles and responsibilities throughout the system development life cycle; c. Identify individuals having information security and privacy roles and responsibilities; and d. Integrate the organizational information security and privacy risk management process into system development life cycle activities.
Quoted verbatim from NIST SP 800-53 Rev 5 (OSCAL catalog), which is in the public domain.
Maps to 2 controls in 2 other frameworks
| Framework | Control |
|---|---|
| HITRUST CSF v11 | 10.e.04 Secure-development principles are applied throughout the lifecycle |
| TISAX (VDA ISA v6) | 5.2.1 Secure development lifecycle is established |
Mappings are CMDash’s own, seeded with the product and shown on both frameworks they connect. In the product they mean evidence you attach here also counts against the controls listed above.
In CMDash this control is a row with an owner, a status, uploaded evidence kept with its full history, and an export an assessor can read.