NIST SP 800-53 Rev 5 MODERATE SA-10: Developer Configuration Management

What else in your programme already covers this

This control maps to 33 controls across 13 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27002:2022 · 6 controls

5.37 Documented operating procedures
8.25 Secure development life cycle
8.30 Outsourced development
8.32 Change management
8.4 Access to source code
8.9 Configuration management

ISO 27001:2022 · 5 controls

5.37 Documented operating procedures
8.25 Secure development life cycle
8.30 Outsourced development
8.32 Change management
8.9 Configuration management

PCI DSS 4.0 · 4 controls

6.3.2 An inventory of bespoke and custom software, and third-party software components incorporated into bespoke and custom software is maintained to facilitate vulnerability and patch management
6.5.1 Changes to all system components in the production environment are made according to established procedures that include: • Reason for, and description of, the change. • Documentation of security impact. • Documented change approval
6.5.3 Pre-production environments are separated from production environments and the separation is enforced with access controls
6.5.4 Roles and functions are separated between production and pre-production environments to provide accountability such that only reviewed and approved changes are deployed

C5 (Germany) · 3 controls

C5-DEV-02 Outsourcing of the development
C5-DEV-07 Logging of changes
C5-DEV-08 Version Control

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

CCM-AIS-06 Automated Secure Application Deployment
CCM-CCC-01 Change Management Policy and Procedures
CCM-CCC-05 Change Agreements

NIST SP 800-218 · 3 controls

SP800-218-PO.3.2 Toolchain Configuration and Integration
SP800-218-PS.1.1 Protect All Forms of Code from Unauthorized Modification
SP800-218-PS.2.1 Provide a Mechanism for Verifying Software Release Integrity

Azure Security Benchmark · 2 controls

ASBv3-DS-3 Secure DevOps infrastructure
DS-6 Enforce security of workload throughout DevOps lifecycle

NIST SP 800-53 Rev 5 · 2 controls

NIST800-SA-10 Developer configuration management
NIST800-SR-4 Provenance. Document, monitor, and maintain valid provenance of the following systems, system components, and associated data: [organization-defined]

AWS Well-Architected Security Pillar · 1 control

SEC01-BP06 Automate deployment of standard security controls

CIS Controls v8 · 1 control

CIS-16.1 Establish and Maintain a Secure Application Development Process

ISO 27701:2019 · 1 control

6.11.2 Security in development and support processes

NIST SP 800-161 Rev 1 · 1 control

161R1-SA-10 Developer Configuration Management

SOC 2 · 1 control

SOC2-CC8.1 Change management processes are in place

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.