800-53 · SA System and Services Acquisition
SA-8
Security and Privacy Engineering Principles
frameworkNIST SP 800-53 Rev 5.2
sectionSA System and Services Acquisition
csf 2.0ID.AM-08 ID.IM-01 ID.IM-02 ID.IM-03 PR.DS-10 PR.IR-03 PR.PS-06
topicsSecure Development
frameworks6 2 0
Official textApply the following systems security and privacy engineering principles in the specification, design, development, implementation, and modification of the system and system components: [Assignment: organization-defined organization-defined systems security and privacy engineering principles].NIST SP 800-53 Rev 5.2 control statement (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.PS-06 | Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle | Crosswalk | Same topic: Secure Development3 loosely related (not mappings)ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles Only shares CSF ID.AM-08: related, not a mapping PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected Only shares CSF PR.DS-10: related, not a mapping PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations Only shares CSF PR.IR-03: related, not a mapping |
| ISO 27001 | A.8.25A.8.26A.8.28A.8.29A.8.27 | Secure development life cycle; Application security requirements… | Crosswalk | Same topic: Secure Development NIST SP 800-53 → ISO 27001 mapping 29 loosely related (not mappings)A.5.19 Information security in supplier relationships Only shares CSF ID.AM-08, ID.IM-02: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF PR.DS-10, PR.IR-03: related, not a mapping A.5.9 Inventory of information and other associated assets Only shares CSF ID.AM-08: related, not a mapping A.5.10 Acceptable use of information and other associated assets Only shares CSF PR.DS-10: related, not a mapping …and 21 more in the downloads |
| CIS v8.1 | CIS 16.1CIS 16.2CIS 16.3CIS 16.5CIS 16.8CIS 16.9CIS 16.11CIS 16.12CIS 16.13CIS 16.14 | Establish and Maintain a Secure Application Development Process; Establish and Maintain a Process to Accept and Address Software Vulnerabilities… | Crosswalk | Same topic: Secure Development17 loosely related (not mappings)CIS 1.1 Establish and Maintain Detailed Enterprise Asset Inventory Only shares CSF ID.AM-08: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Only shares CSF ID.AM-08: related, not a mapping …and 9 more in the downloads |
| SOC 2 | CC8.1 | Change management for infrastructure, data and software | Editorial | Same topic: Secure Development (editorial pick)9 loosely related (not mappings)A1.1 Capacity management to meet availability commitments Only shares CSF PR.IR-03: related, not a mapping A1.2 Environmental protections, backups and recovery infrastructure Only shares CSF PR.IR-03: related, not a mapping CC6.1 Logical access security over information assets Only shares CSF ID.AM-08: related, not a mapping CC6.5 Protection of data when assets are disposed of Only shares CSF PR.DS-10: related, not a mapping CC6.6 Protection against threats from outside system boundaries Only shares CSF PR.PS-06: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Only shares CSF PR.DS-10: related, not a mapping …and 1 more in the downloads |
| PCI DSS | 6.2.26.2.36.2.1 | Developers trained in secure software development; Custom code reviewed before release… | Crosswalk | Same topic: Secure Development18 loosely related (not mappings)6.2.4 Coding techniques prevent common software attacks Only shares CSF ID.AM-08, PR.PS-06: related, not a mapping 6.3.3 Security patches installed promptly Only shares CSF ID.AM-08, ID.IM-03: related, not a mapping 11.4.4 Penetration test findings corrected and retested Only shares CSF ID.IM-02, PR.PS-06: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Only shares CSF ID.AM-08, ID.IM-01: related, not a mapping 12.10.2 Incident response plan reviewed and tested annually Only shares CSF ID.IM-02, PR.IR-03: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Only shares CSF ID.IM-02, PR.IR-03: related, not a mapping 3.2.1 Account data storage minimised, with retention and disposal Only shares CSF PR.DS-10: related, not a mapping …and 10 more in the downloads |
| CMMC | SC.L2-3.13.2SC.L2-3.13.1 | Security Engineering; Boundary Protection | Crosswalk | Same topic: Secure Development NIST SP 800-171r2 Appendix D 20 loosely related (not mappings)CA.L2-3.12.4 System Security Plan Only shares CSF ID.AM-08, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, PR.DS-10: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, PR.DS-10: related, not a mapping …and 12 more in the downloads |
| HIPAA | §164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)§164.308(a)(3)§164.308(a)(3)(ii)(A) | Risk Management; Information System Activity Review… | No mapping. Only shares CSF ID.AM-08, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping+34 more loosely related (not mappings)§164.308(a)(3)(ii)(B) Workforce Clearance Procedure Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, PR.DS-10: related, not a mapping §164.308(a)(4) Information Access Management Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, PR.DS-10: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, PR.DS-10: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, PR.DS-10: related, not a mapping …and 30 more in the downloads | |
| GDPR | Art.25(1) | Data protection by design and by default | Editorial | Same topic: Secure Development (editorial pick)5 loosely related (not mappings)Art.5(1)(e) Principles relating to processing of personal data Only shares CSF PR.DS-10: related, not a mapping Art.5(1)(f) Principles relating to processing of personal data Only shares CSF PR.DS-10: related, not a mapping |
| NIS2 | 6.2 | Secure development life cycle | Crosswalk | Same topic: Secure Development |
| Essential Eight | ISM-1515ISM-1807 | Restoration of data, applications and settings from backups to a common point in time…; An automated method of asset discovery is used at least fortnightly to support the… | No mapping. Only shares CSF PR.IR-03, ID.AM-08: related, not a mapping | |
| DORA | Art.8(1)Art.8(4)Art.8(6)Art.9(2) | Identification; Identification… | No mapping. Only shares CSF ID.AM-08, PR.DS-10: related, not a mapping+6 more loosely related (not mappings)…and 2 more in the downloads | |
| CPS 234 | Para 20Para 21 | Classify information assets by criticality and sensitivity; Timely controls commensurate with risk and asset life-cycle | No mapping. Only shares CSF ID.AM-08, PR.DS-10: related, not a mapping | |
| Cyber Essentials | CE 3 | Security Update Management | No mapping. Only shares CSF ID.AM-08: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.