Developer Configuration Management

frameworkNIST SP 800-53 Rev 5.2 sectionSA System and Services Acquisition csf 2.0ID.RA-09 PR.PS-02 PR.PS-03 PR.PS-06 topics— frameworks1 0 0

Official textRequire the developer of the system, system component, or system service to:
a. Perform configuration management during system, component, or service [Selection (one or more): design; development; implementation; operation; disposal];
b. Document, manage, and control the integrity of changes to [Assignment: organization-defined configuration items];
c. Implement only organization-approved changes to the system, component, or service;
d. Document approved changes to the system, component, or service and the potential security and privacy impacts of such changes; and
e. Track security flaws and flaw resolution within the system, component, or service and report findings to [Assignment: organization-defined personnel].NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of SA-10 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.RA-09 PR.PS-02 PR.PS-03 PR.PS-06	The authenticity and integrity of hardware and software are assessed prior to acquisition and use; Software is maintained, replaced, and removed commensurate with risk…	Loosely related	No mapping. Only shares CSF ID.RA-09, PR.PS-02, PR.PS-03, PR.PS-06: related, not a mapping
ISO 27001	A.8.9 A.8.28 A.8.30 A.8.32	Configuration management; Secure coding…	Crosswalk	NIST SP 800-53 → ISO 27001 mapping 10 loosely related (not mappings) A.5.9 Inventory of information and other associated assets Loosely related Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF ID.RA-09: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF ID.RA-09: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF ID.RA-09: related, not a mapping A.8.1 User endpoint devices Loosely related Only shares CSF PR.PS-03: related, not a mapping A.8.7 Protection against malware Loosely related Only shares CSF PR.PS-02: related, not a mapping A.8.25 Secure development life cycle Loosely related Only shares CSF PR.PS-06: related, not a mapping A.8.26 Application security requirements Loosely related Only shares CSF PR.PS-06: related, not a mapping …and 2 more in the downloads
CIS v8.1	CIS 1.2 CIS 2.2 CIS 2.3 CIS 16.1	Address Unauthorized Assets; Ensure Authorized Software is Currently Supported…	Loosely related	No mapping. Only shares CSF PR.PS-03, PR.PS-02, PR.PS-06: related, not a mapping +15 more loosely related (not mappings) CIS 7.3 Perform Automated Operating System Patch Management Loosely related Only shares CSF PR.PS-02: related, not a mapping CIS 7.4 Perform Automated Application Patch Management Loosely related Only shares CSF PR.PS-02: related, not a mapping CIS 9.3 Maintain and Enforce Network-Based URL Filters Loosely related Only shares CSF PR.PS-06: related, not a mapping CIS 12.1 Ensure Network Infrastructure is Up-to-Date Loosely related Only shares CSF PR.PS-02: related, not a mapping …and 11 more in the downloads
SOC 2	CC6.6 CC7.1 CC8.1 CC9.2	Protection against threats from outside system boundaries; Detecting configuration changes and new vulnerabilities…	Loosely related	No mapping. Only shares CSF PR.PS-06, PR.PS-02, ID.RA-09: related, not a mapping
PCI DSS	6.3.2 6.4.3 9.5.1.1 12.3.4	Inventory of custom software and its components; Payment page scripts authorised and integrity-checked…	Loosely related	No mapping. Only shares CSF PR.PS-02, PR.PS-06, ID.RA-09, PR.PS-03: related, not a mapping +9 more loosely related (not mappings) 6.2.2 Developers trained in secure software development Loosely related Only shares CSF PR.PS-06: related, not a mapping 6.2.3 Custom code reviewed before release Loosely related Only shares CSF PR.PS-06: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF PR.PS-02: related, not a mapping 6.3.3 Security patches installed promptly Loosely related Only shares CSF PR.PS-02: related, not a mapping …and 5 more in the downloads
CMMC	MA.L2-3.7.1 MA.L2-3.7.2 MA.L2-3.7.4 RA.L2-3.11.1	Perform Maintenance; System Maintenance Control…	Loosely related	No mapping. Only shares CSF PR.PS-02, ID.RA-09: related, not a mapping +2 more loosely related (not mappings) SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF PR.PS-06: related, not a mapping SI.L2-3.14.1 Flaw Remediation Loosely related Only shares CSF PR.PS-02: related, not a mapping
HIPAA	§164.312(c)§164.312(c)(2)§164.312(e)(2)(i)§164.308(b)(4)	Integrity; Mechanism to Authenticate Electronic Protected Health Information…	Loosely related	No mapping. Only shares CSF ID.RA-09, PR.PS-02: related, not a mapping +3 more loosely related (not mappings) §164.314(a) Business Associate Contracts or Other Arrangements Loosely related Only shares CSF ID.RA-09: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF ID.RA-09: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF ID.RA-09: related, not a mapping
GDPR	Art.25(1)Art.28(1)	Data protection by design and by default; Processor	Loosely related	No mapping. Only shares CSF PR.PS-06, ID.RA-09: related, not a mapping
NIS2	6.10 6.1 6.2 6.6	Vulnerability handling and disclosure; Security in acquisition of ICT services, ICT systems or ICT products…	Loosely related	No mapping. Only shares CSF PR.PS-02, PR.PS-03, ID.RA-09, PR.PS-06: related, not a mapping
Essential Eight	ISM-1407 ISM-1501 ISM-1694 ISM-1695	The latest release, or the previous release, of operating systems are used; Operating systems that are no longer supported by vendors are replaced…	Loosely related	No mapping. Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping +25 more loosely related (not mappings) ISM-1696 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of… Loosely related Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping ISM-1697 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release… Loosely related Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping ISM-1701 A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in… Loosely related Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping ISM-1702 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of… Loosely related Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping …and 21 more in the downloads
DORA	Art.9(4)(f)Art.28(2)Art.29(1)Art.29(2)	Protection and prevention; General principles…	Loosely related	No mapping. Only shares CSF PR.PS-02, ID.RA-09: related, not a mapping
CPS 234	Para 16 Para 22	Assess third parties' information security capability; Evaluate the design of third parties' controls	Loosely related	No mapping. Only shares CSF ID.RA-09: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF PR.PS-02: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.