Developer Security and Privacy Architecture and Design

frameworkNIST SP 800-53 Rev 5.2 sectionSA System and Services Acquisition csf 2.0ID.IM-01 ID.RA-09 PR.PS-06 topics— frameworks1 0 2

Official textRequire the developer of the system, system component, or system service to produce a design specification and security and privacy architecture that:
a. Is consistent with the organization’s security and privacy architecture that is an integral part the organization’s enterprise architecture;
b. Accurately and completely describes the required security and privacy functionality, and the allocation of controls among physical and logical components; and
c. Expresses how individual security and privacy functions, mechanisms, and services work together to provide required security and privacy capabilities and a unified approach to protection.NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of SA-17 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.RA-09 PR.PS-06	The authenticity and integrity of hardware and software are assessed prior to acquisition and use; Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle	Loosely related	No mapping. Only shares CSF ID.RA-09, PR.PS-06: related, not a mapping
ISO 27001	A.8.25 A.8.27	Secure development life cycle; Secure system architecture and engineering principles	Crosswalk	NIST SP 800-53 → ISO 27001 mapping 7 loosely related (not mappings) A.5.19 Information security in supplier relationships Loosely related Only shares CSF ID.RA-09: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF ID.RA-09: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF ID.RA-09: related, not a mapping A.8.26 Application security requirements Loosely related Only shares CSF PR.PS-06: related, not a mapping A.8.28 Secure coding Loosely related Only shares CSF PR.PS-06: related, not a mapping A.8.29 Security testing in development and acceptance Loosely related Only shares CSF PR.PS-06: related, not a mapping A.8.31 Separation of development, test and production environments Loosely related Only shares CSF PR.PS-06: related, not a mapping
CIS v8.1	CIS 16.1 CIS 9.3 CIS 13.10 CIS 16.2	Establish and Maintain a Secure Application Development Process; Maintain and Enforce Network-Based URL Filters…	Loosely related	No mapping. Only shares CSF PR.PS-06: related, not a mapping +9 more loosely related (not mappings) CIS 16.3 Perform Root Cause Analysis on Security Vulnerabilities Loosely related Only shares CSF PR.PS-06: related, not a mapping CIS 16.5 Use Up-to-Date and Trusted Third-Party Software Components Loosely related Only shares CSF PR.PS-06: related, not a mapping CIS 16.8 Separate Production and Non-Production Systems Loosely related Only shares CSF PR.PS-06: related, not a mapping CIS 16.9 Train Developers in Application Security Concepts and Secure Coding Loosely related Only shares CSF PR.PS-06: related, not a mapping …and 5 more in the downloads
SOC 2	CC6.6 CC8.1 CC9.2	Protection against threats from outside system boundaries; Change management for infrastructure, data and software…	Loosely related	No mapping. Only shares CSF PR.PS-06, ID.RA-09: related, not a mapping
PCI DSS	6.4.3 6.2.2 6.2.3 6.3.2	Payment page scripts authorised and integrity-checked; Developers trained in secure software development…	Loosely related	No mapping. Only shares CSF ID.RA-09, PR.PS-06: related, not a mapping +5 more loosely related (not mappings) 9.5.1.1 Inventory of POI devices kept Loosely related Only shares CSF ID.RA-09: related, not a mapping 11.4.4 Penetration test findings corrected and retested Loosely related Only shares CSF PR.PS-06: related, not a mapping 6.2.1 Bespoke and custom software developed securely Loosely related Only shares CSF PR.PS-06: related, not a mapping 6.2.4 Coding techniques prevent common software attacks Loosely related Only shares CSF PR.PS-06: related, not a mapping …and 1 more in the downloads
CMMC	RA.L2-3.11.1 SC.L2-3.13.2	Risk Assessments; Security Engineering	Loosely related	No mapping. Only shares CSF ID.IM-01, ID.RA-09, PR.PS-06: related, not a mapping
HIPAA	§164.312(c)§164.308(b)(4)§164.312(c)(2)§164.312(e)(2)(i)	Integrity; Written Contract or Other Arrangement…	Loosely related	No mapping. Only shares CSF ID.IM-01, ID.RA-09: related, not a mapping +3 more loosely related (not mappings) §164.314(a) Business Associate Contracts or Other Arrangements Loosely related Only shares CSF ID.RA-09: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF ID.RA-09: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF ID.RA-09: related, not a mapping
GDPR	Art.25(1)Art.28(1)	Data protection by design and by default; Processor	Loosely related	No mapping. Only shares CSF PR.PS-06, ID.RA-09: related, not a mapping
NIS2	6.1 6.2	Security in acquisition of ICT services, ICT systems or ICT products; Secure development life cycle	Loosely related	No mapping. Only shares CSF ID.RA-09, PR.PS-06: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.28(2)Art.29(1)Art.29(2)	General principles; Preliminary assessment of ICT concentration risk at entity level…	Loosely related	No mapping. Only shares CSF ID.RA-09: related, not a mapping
CPS 234	Para 16 Para 22	Assess third parties' information security capability; Evaluate the design of third parties' controls	Loosely related	No mapping. Only shares CSF ID.RA-09: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.