System Development Life Cycle SA-3
System and Services Acquisition · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds SA-3 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, System and Services Acquisition family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
SA-3 (System Development Life Cycle) says that however you acquire, build, and run a system, you do it through a defined life cycle that bakes in security and privacy from day one — not bolted on at the end. It also asks you to name who holds the security and privacy roles at each stage and to fold risk management into that whole cycle. It is a Low-baseline control.
What good looks like
- Use a defined life cycle (an SDLC — System Development Life Cycle) that carries a system from request to build to run to retirement, with security and privacy considered at every stage.
- Assign the roles. Write down who is responsible for security and privacy across that life cycle — and name the actual people, not just titles.
- Fold in risk management. Make your risk process part of the life cycle, so risks are weighed as the system changes, not just once at launch.
- Cover the whole span — from first setup through decommissioning — including how you patch, rebuild, and eventually retire the server.
Framework mapping
- NIST CSF 2.0 — ID.AM-08 — Systems, hardware, software, services, and data are managed throughout their life cycles
- CIS Controls v8 — Control 16 — Application Software Security
How to move it toward Implemented
- Write a one-page life-cycle note for the lab server: how it gets built (base image, packages), how it is changed and patched, who signs off, and how it will be retired and wiped.
- Record the current build so it is reproducible — capture the OS (Operating System) version (
cat /etc/os-release) and installed packages (dpkg -lorrpm -qa) into a dated inventory file. - Name the security and privacy owner for each stage in that note, and state where the risk register lives.
- Attach that life-cycle note and build inventory as hardening evidence on the asset, naming
SA-3in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.