Developer Testing and Evaluation SA-11

System and Services Acquisition · Moderate baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds SA-11 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, System and Services Acquisition family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

SA-11 (Developer Testing and Evaluation) is about proving the security of what you build, not hoping it works. The builder plans ongoing security testing, actually runs it — unit, integration, system, or regression tests — keeps the evidence, fixes the flaws it finds, and verifies the fixes hold. It comes in at the Moderate baseline.

What good looks like

Have a written test plan that says what security testing happens and how often — not a single check bolted on at the end.
Run real tests — unit and integration tests for your scripts, plus vulnerability and configuration scans of the server.
Keep the evidence — save scan reports and test output with dates, so you can show the work rather than just claim it.
Follow a verifiable flaw-remediation process: findings are logged, fixed, and re-checked.
Re-test after fixes (regression) so a change does not quietly reopen an old hole.

Framework mapping

NIST CSF 2.0 — ID.RA-01 — Vulnerabilities in assets are identified, validated, and recorded
CIS Controls v8 — Control 16 — Application Software Security

How to move it toward Implemented

Run a configuration and vulnerability scan — for example, lynis audit system and an OpenSCAP scan (oscap) — and save the dated report.
Add automated checks for your build scripts — a test runner, plus shellcheck on shell scripts — and record the results.
Log each finding, fix it, and re-run the scan to confirm the finding is gone.
Attach the before-and-after scan reports and test output as hardening evidence on the asset, naming SA-11 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.