SA — System and Services Acquisition

SA-1Policy and ProceduresLowModerateHighPrivacy SA-2Allocation of ResourcesLowModerateHighPrivacy SA-3System Development Life CycleLowModerateHighPrivacy SA-4Acquisition ProcessLowModerateHighPrivacy SA-5System DocumentationLowModerateHigh SA-6Software Usage RestrictionsWithdrawn SA-7User-installed SoftwareWithdrawn SA-8Security and Privacy Engineering PrinciplesLowModerateHigh SA-9External System ServicesLowModerateHighPrivacy SA-10Developer Configuration ManagementModerateHigh SA-11Developer Testing and EvaluationModerateHighPrivacy SA-12Supply Chain ProtectionWithdrawn SA-13TrustworthinessWithdrawn SA-14Criticality AnalysisWithdrawn SA-15Development Process, Standards, and ToolsModerateHigh SA-16Developer-provided TrainingHigh SA-17Developer Security and Privacy Architecture and DesignHigh SA-18Tamper Resistance and DetectionWithdrawn SA-19Component AuthenticityWithdrawn SA-20Customized Development of Critical ComponentsNot in a baseline SA-21Developer ScreeningHigh SA-22Unsupported System ComponentsLowModerateHigh SA-23SpecializationNot in a baseline SA-24Design For Cyber ResiliencyNot in a baseline