NIST 800-53 r5 · Controls catalogue · Family SA
SA-15Development Process, Standards, and Tools
Require the developer of the system, system component, or system service to follow a documented development process that: Explicitly addresses security and privacy requirements; Identifies the standards and tools used in the development process; Documents the specific tool options and tool configurations used in the development process; and Documents, manages, and ensures the integrity of changes to the process and/or tools used in development; and Review the development process, standards, tools, tool options, and tool configurations {{ insert: param, sa-15_odp.01 }} to determine if the process, standards, tools, tool options and tool configurations selected and employed can satisfy the following security and privacy requirements: {{ insert: param, sa-15_prm_2 }}.
Last updated: 20 August 2026 13:14 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (14)
- T1078 Valid Accounts Stealth, Persistence, Privilege Escalation, Initial Access
- T1078.001 Default Accounts Stealth, Persistence, Privilege Escalation, Initial Access
- T1078.003 Local Accounts Stealth, Persistence, Privilege Escalation, Initial Access
- T1078.004 Cloud Accounts Stealth, Persistence, Privilege Escalation, Initial Access
- T1195.001 Compromise Software Dependencies and Development Tools Initial Access
- T1213.003 Code Repositories Collection
- T1528 Steal Application Access Token Credential Access
- T1552 Unsecured Credentials Credential Access
- T1552.001 Credentials In Files Credential Access
- T1552.002 Credentials in Registry Credential Access
- T1552.004 Private Keys Credential Access
- T1552.006 Group Policy Preferences Credential Access
- T1558.004 AS-REP Roasting Credential Access
- T1574.001 DLL Stealth, Execution
Weaknesses this control addresses (6)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-693 | Protection Mechanism Failure | 700+ | Mandates review that the selected process, standards, and tools can satisfy security requirements, reducing failure of protection mechanisms in the delivered system. |
CWE-707 | Improper Neutralization | 200+ | Enforces use of documented standards and tool configurations that address proper neutralization of inputs/outputs during development. |
CWE-703 | Improper Check or Handling of Exceptional Conditions | 100+ | Standards and tools mandated by the process include proper handling of exceptional conditions that would otherwise be omitted. |
CWE-664 | Improper Control of a Resource Through its Lifetime | 47 | Requires a managed development lifecycle process with integrity controls on changes, improving control of resources throughout their lifetime. |
CWE-1104 | Use of Unmaintained Third Party Components | 26 | Tool and standards review plus change-integrity requirements reduce selection and continued use of unmaintained third-party components. |
CWE-657 | Violation of Secure Design Principles | 20 | Directly requires a documented process that explicitly addresses security requirements and uses reviewed standards, preventing violations of secure design principles. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2026-32841 UPD | 6.2 | 8.1 | 0.0060 | partial |
CVE-2024-0159 UPD | 4.9 | 6.7 | 0.0019 | partial |
CVE-2024-38301 UPD | 4.9 | 6.7 | 0.0014 | partial |
CVE-2025-47153 UPD | 4.8 | 6.5 | 0.0038 | partial |
CVE-2024-47827 UPD | 4.5 | 5.7 | 0.0036 | partial |
CVE-2025-0007 UPD | 4.0 | 5.7 | 0.0011 | good |
CVE-2023-32642 UPD | 3.7 | 4.3 | 0.0037 | good |
CVE-2026-56847 | 2.8 | 3.3 | 0.0016 | partial |
CVE-2025-24201 KEV UPD | 10.0 | 10.0 | 0.0412 | partial |
CVE-2025-43300 KEV UPD | 10.0 | 10.0 | 0.2039 | partial |
CVE-2024-21762 KEV UPD | 9.9 | 9.8 | 0.8428 | partial |
CVE-2024-37079 KEV UPD | 9.9 | 9.8 | 0.2238 | partial |
CVE-2025-9242 KEV UPD | 9.9 | 9.8 | 0.9130 | partial |
CVE-2025-14733 KEV UPD | 9.9 | 9.8 | 0.2651 | partial |
CVE-2026-0300 KEV UPD | 9.9 | 9.8 | 0.3207 | partial |
CVE-2024-0519 KEV UPD | 9.2 | 8.8 | 0.0380 | partial |
CVE-2024-4761 KEV UPD | 9.2 | 8.8 | 0.1101 | partial |
CVE-2024-7965 KEV UPD | 9.2 | 8.8 | 0.1853 | partial |
CVE-2025-5419 KEV UPD | 9.2 | 8.8 | 0.0763 | partial |
CVE-2025-41646 UPD | 9.2 | 9.8 | 0.4512 | partial |
CVE-2025-21042 KEV UPD | 9.2 | 8.8 | 0.3317 | partial |
CVE-2025-21043 KEV UPD | 9.2 | 8.8 | 0.0189 | partial |
CVE-2025-14174 KEV | 9.2 | 8.8 | 0.2263 | partial |
CVE-2026-3909 KEV UPD | 9.2 | 8.8 | 0.0163 | partial |
CVE-2026-11645 KEV UPD | 9.2 | 8.8 | 0.0219 | partial |