NIST 800-53 r5 · Controls catalogue · Family SA
SA-17Developer Security and Privacy Architecture and Design
Require the developer of the system, system component, or system service to produce a design specification and security and privacy architecture that: Is consistent with the organization’s security and privacy architecture that is an integral part the organization’s enterprise architecture; Accurately and completely describes the required security and privacy functionality, and the allocation of controls among physical and logical components; and Expresses how individual security and privacy functions, mechanisms, and services work together to provide required security and privacy capabilities and a unified approach to protection.
Last updated: 04 July 2026 08:17 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 12 mapping(s) from 3 framework(s): ASVS 5.0 9 (partial) · OWASP-Web 2 (partial) · CSF 2.0 1 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (7)
- T1078 Valid Accounts Stealth, Persistence, Privilege Escalation, Initial Access
- T1078.001 Default Accounts Stealth, Persistence, Privilege Escalation, Initial Access
- T1078.003 Local Accounts Stealth, Persistence, Privilege Escalation, Initial Access
- T1078.004 Cloud Accounts Stealth, Persistence, Privilege Escalation, Initial Access
- T1134.005 SID-History Injection Stealth, Privilege Escalation
- T1482 Domain Trust Discovery Discovery
- T1574.001 DLL Stealth, Execution
Weaknesses this control addresses (7)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-284 | Improper Access Control | 5,385 | Requires explicit allocation of controls to physical and logical components, directly preventing architectural gaps in access enforcement. |
CWE-306 | Missing Authentication for Critical Function | 2,820 | Demands complete description of required security functionality, making omission of authentication for critical functions far less likely. |
CWE-732 | Incorrect Permission Assignment for Critical Resource | 1,875 | Mandates accurate specification of control allocation, making incorrect default or assigned permissions on critical resources less probable at design time. |
CWE-693 | Protection Mechanism Failure | 614 | Requires demonstrating integration of mechanisms into a coherent protection strategy, reducing failures from poorly composed or conflicting controls. |
CWE-1220 | Insufficient Granularity of Access Control | 94 | Requires the architecture to describe granularity and placement of controls, preventing insufficiently fine-grained access decisions. |
CWE-653 | Improper Isolation or Compartmentalization | 66 | Requires the architecture to show how functions work together as a unified protection approach, reducing improper isolation or compartmentalization. |
CWE-657 | Violation of Secure Design Principles | 19 | Enforces production of a design consistent with secure architecture principles and enterprise goals, directly addressing violation of secure design principles. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2024-24324 UPD | 7.0 | 9.8 | 0.0066 | good |