NIST 800-53 r5 · Controls catalogue · Family SA

SA-10Developer Configuration Management

Require the developer of the system, system component, or system service to: Perform configuration management during system, component, or service {{ insert: param, sa-10_odp.01 }}; Document, manage, and control the integrity of changes to {{ insert: param, sa-10_odp.02 }}; Implement only organization-approved changes to the system, component, or service; Document approved changes to the system, component, or service and the potential security and privacy impacts of such changes; and Track security flaws and flaw resolution within the system, component, or service and report findings to {{ insert: param, sa-10_odp.03 }}.

Last updated: 21 August 2026 07:11 UTC

Implementations targeting this control (0)

No implementations targeting this control yet.

ATT&CK techniques this control mitigates (27)

T1072 Software Deployment Tools Execution, Lateral Movement
T1078 Valid Accounts Stealth, Persistence, Privilege Escalation, Initial Access
T1078.001 Default Accounts Stealth, Persistence, Privilege Escalation, Initial Access
T1078.003 Local Accounts Stealth, Persistence, Privilege Escalation, Initial Access
T1078.004 Cloud Accounts Stealth, Persistence, Privilege Escalation, Initial Access
T1195.001 Compromise Software Dependencies and Development Tools Initial Access
T1195.003 Compromise Hardware Supply Chain Initial Access
T1213.003 Code Repositories Collection
T1495 Firmware Corruption Impact
T1505 Server Software Component Persistence
T1505.001 SQL Stored Procedures Persistence
T1505.002 Transport Agent Persistence
T1505.004 IIS Components Persistence
T1542 Pre-OS Boot Stealth, Persistence
T1542.001 System Firmware Stealth, Persistence
T1542.003 Bootkit Stealth, Persistence
T1542.004 ROMMONkit Stealth, Persistence
T1542.005 TFTP Boot Stealth, Persistence
T1553 Subvert Trust Controls Defense Impairment
T1553.006 Code Signing Policy Modification Defense Impairment
T1559.003 XPC Services Execution
T1564.009 Resource Forking Stealth
T1574.001 DLL Stealth, Execution
T1601 Modify System Image Defense Impairment
T1601.001 Patch System Image Defense Impairment
T1601.002 Downgrade System Image Defense Impairment
T1647 Plist File Modification Defense Impairment

Weaknesses this control addresses (5)AI-assisted

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE	Name	CVEs	Why this control addresses it
`CWE-494`	Download of Code Without Integrity Check	200+	Mandating integrity control and approved-only changes during development prevents incorporation of code or components lacking integrity validation.
`CWE-506`	Embedded Malicious Code	99	Requiring documented, approved changes plus security flaw tracking makes undetected insertion of malicious code substantially harder.
`CWE-912`	Hidden Functionality	87	Change control, approval gates, and flaw tracking force hidden functionality to be either documented or discovered and removed.
`CWE-353`	Missing Support for Integrity Check	44	Requiring control over the integrity of all changes directly compels developers to implement integrity verification mechanisms rather than omitting them.
`CWE-1104`	Use of Unmaintained Third Party Components	26	Configuration management and explicit tracking of security flaws require identification and remediation of unmaintained or vulnerable third-party components.

Top CVEs where this control is the strongest mitigation

CVE	Risk	CVSS	EPSS	Match
`CVE-2025-48905`	6.0	8.1	0.0026	partial
`CVE-2024-3845`	3.9	4.3	0.0086	partial
`CVE-2026-8149`	3.5	5.1	0.0016	partial
`CVE-2023-5457`	5.9	7.5	0.0064	good
`CVE-2024-23591`	1.9	2.0	0.0016	good
`CVE-2025-3946`	6.3	8.2	0.0049	partial
`CVE-2023-52360`	5.7	7.5	0.0029	partial
`CVE-2025-3108`	5.7	7.5	0.0043	partial
`CVE-2024-43798`	6.2	8.6	0.0045	partial

Other controls in family SA

SA-1 SA-11 SA-12 SA-13 SA-14 SA-15 SA-16 SA-17 SA-18 SA-19 SA-2 SA-20 SA-21 SA-22 SA-23 SA-24 SA-3 SA-4 SA-5 SA-6 SA-7 SA-8 SA-9