Security and Privacy Engineering Principles SA-8
System and Services Acquisition · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds SA-8 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, System and Services Acquisition family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
SA-8 (Security and Privacy Engineering Principles) asks you to build and change systems using sound engineering principles — ideas like least privilege, defense in depth, secure defaults, and a small attack surface — rather than making it up as you go. On a running server this shows up as deliberate choices about what is installed, what is exposed, and who can do what. It is a Low-baseline control.
What good looks like
- Pick your principles and write them down — least privilege, defense in depth, secure-by-default, and minimizing the attack surface are common ones.
- Apply them through the whole life cycle — in how the system is specified, designed, built, and later modified, not just at the start.
- Least privilege in practice — give accounts and services only the access they need, and no more.
- Shrink the attack surface — remove packages and services you do not use, and close ports you do not need.
- Secure defaults — choose the safer setting out of the box, so a missed step fails closed rather than open.
Framework mapping
- NIST CSF 2.0 — PR.PS-06 — Secure software development practices are integrated and monitored across the software development life cycle
- CIS Controls v8 — Control 16 — Application Software Security
How to move it toward Implemented
- Write a short engineering-principles note naming the principles you hold this server to (least privilege, defense in depth, secure defaults, minimal surface) and how each shows up in the build.
- Trim the attack surface — list running services (
systemctl list-units --type=service --state=running) and listening ports (ss -tulpn), then remove or disable anything you do not need. - Prove least privilege — review the sudoers list and file permissions on sensitive paths, and record that services run as non-root where possible.
- Attach that principles note and the service/port review as hardening evidence on the asset, naming
SA-8in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.