NIST SP 800-53 Rev 5
SA - System and Services Acquisition

NIST SP 800-53 Rev 5 NIST800-SA-10: Developer configuration management

Requires the developer of the system, component or service to perform configuration management during defined life cycle stages, to document and control the integrity of changes to defined configuration items, to implement only organization-approved changes, to document approved changes with their potential security and privacy impacts, and to track security flaws and their resolution and report findings to defined personnel.

What else in your programme already covers this

This control maps to 114 controls across 55 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CIS Controls v8 · 4 controls

  • CIS-16.1 Establish and Maintain a Secure Application Development Process
  • CIS-16.7 Use Standard Hardening Configuration Templates for Application Infrastructure
  • CIS-16.8 Separate Production and Non-Production Systems
  • CIS-4.1 Establish and Maintain a Secure Configuration Process

ISO 27001:2022 · 4 controls

  • 8.25 Secure development life cycle
  • 8.30 Outsourced development
  • 8.32 Change management
  • 8.9 Configuration management

ISO 27002:2022 · 4 controls

  • 8.25 Secure development life cycle
  • 8.30 Outsourced development
  • 8.32 Change management
  • 8.9 Configuration management

NIST Cybersecurity Framework 2.0 · 4 controls

  • NIST-CSF-ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles
  • NIST-CSF-PR.DS-11 Backups of data are created, protected, maintained, and tested
  • NIST-CSF-PR.PS-01 Configuration management practices are established and applied
  • NIST-CSF-PR.PS-06 Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle

PCI DSS 4.0 · 4 controls

  • 1.2.8 Configuration files secured and synchronised
  • 6.5.1 Changes to all system components in the production environment are made according to established procedures that include: • Reason for, and description of, the change. • Documentation of security impact. • Documented change approval
  • 6.5.3 Pre-production environments are separated from production environments and the separation is enforced with access controls
  • 6.5.4 Roles and functions are separated between production and pre-production environments to provide accountability such that only reviewed and approved changes are deployed

ASD Strategies to Mitigate Cyber Security Incidents · 3 controls

  • ASD37-04 User application hardening (Essential)
  • ASD37-10 Server application hardening (Very Good)
  • ASD37-11 Operating system hardening (Very Good)

BSI IT-Grundschutz · 3 controls

  • BSI-23 Baseline configuration establishment
  • BSI-24 Configuration change control
  • BSI-26 System component inventory

NIST SP 800-218 · 3 controls

API 1164 · 2 controls

Azure Security Benchmark · 2 controls

  • ASBv3-DS-3 Secure DevOps infrastructure
  • DS-6 Enforce security of workload throughout DevOps lifecycle

C5 (Germany) · 2 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

  • CCM-AIS-06 Automated Secure Application Deployment
  • CCM-CCC-01 Change Management Policy and Procedures

FedRAMP High · 2 controls

  • SA-10 Developer Configuration Management
  • SA-22 Unsupported System Components. a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for continued support

FedRAMP Moderate · 2 controls

  • SA-10 Developer Configuration Management
  • SA-22 Unsupported System Components. a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for continued support

IEC 62304:2015 Medical Device Software Lifecycle Processes · 2 controls

IEC 62443 · 2 controls

ISO 27017 · 2 controls

ISO 27018 · 2 controls

ISO 27019 · 2 controls

ISO 27701:2019 · 2 controls

  • 6.11.2 Security in development and support processes
  • 6.9.5 Control of operational software

NIST SP 1800-32 · 2 controls

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 2 controls

NIST SP 800-190 · 2 controls

NIST SP 800-53 Rev 5 MODERATE · 2 controls

  • SA-10 Developer Configuration Management
  • SA-22 Unsupported System Components. a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for continued support

NIST SP 800-53 Revision 5.1 HIGH · 2 controls

  • SA-10 Developer Configuration Management
  • SA-22 Unsupported System Components. a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for continued support

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 2 controls

  • NISTSP82-1 OT Security Program Governance, Policy, Roles, and Safety-Security Integration
  • NISTSP82-5 OT Configuration Management, Patching, Vulnerability Management, and Malware Protection

AS9100D - Aerospace Quality Management System · 1 control

AWS Well-Architected Security Pillar · 1 control

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 1 control

Annex 11 to EU GMP - Computerised Systems · 1 control

  • Clause 10 Change and configuration management

Automotive SPICE (ASPICE) v4.0 - Process Assessment Model · 1 control

  • SUP.8 Configuration Management

Canada ITSG-33 - IT Security Risk Management · 1 control

EU AI Act · 1 control

FBI CJIS Security Policy · 1 control

  • CJIS-7 Configuration Management

FFIEC Cybersecurity Assessment Tool (CAT) · 1 control

FFIEC IT Examination Handbook · 1 control

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 1 control

ISO 20000-1 · 1 control

ISO 26262:2018 - Functional Safety for Road Vehicles · 1 control

ISO/IEC 27400:2022 · 1 control

ITIL 4 · 1 control

NIST Privacy Framework · 1 control

  • NISTPF-8 Protect-P Information Protection Processes (PR.PO-P)

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-53 Rev 5 LOW · 1 control

  • SA-22 Unsupported System Components. a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for continued support

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity · 1 control

OSFI B-13 · 1 control

  • OSFIB13-3 Cyber Security: Identification, Protection, Detection, Response, Recovery

Oman National Cybersecurity Framework · 1 control

  • OMANCS-5 Network, Endpoint, System Development, and Configuration Security

Open Banking Security · 1 control

  • OPENBANK-3 Mutual TLS, Token Binding, Request Signing (JWS), Key Management

PCI P2PE · 1 control

PCI PIN Security · 1 control

PCI SSF · 1 control

PSD2 SCA · 1 control

  • PSDTWO-2 SCA Exemptions and Risk-Based Authentication

SOC 2 · 1 control

  • SOC2-CC8.1 Change management processes are in place

Secure by Design: A Guide for Manufacturers (CISA) · 1 control

  • CISABD-1 Take Ownership of Customer Security Outcomes

South Korea ISMS-P · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in SA - System and Services Acquisition

You are reading one control. How much of NIST SP 800-53 Rev 5 have you already done?

NIST SP 800-53 Rev 5 NIST800-SA-10 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-53 Rev 5 your existing evidence covers. Hold ISO 27001:2022 and 163 of 300 NIST SP 800-53 Rev 5 controls already carry evidence.

If you hold ISO 27001:202254.3% covered · 137 gapsIf you hold ISO 27002:202236.7% covered · 190 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.134.3% covered · 197 gapsIf you hold CIS Controls v834% covered · 198 gapsIf you hold NIST SP 800-171 Rev 334% covered · 198 gapsIf you hold C5 (Germany)32.3% covered · 203 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 342 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 114 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-53 Rev 5 controls