NIST 800-53 r5 · Controls catalogue · Family SA
SA-21Developer Screening
Require that the developer of {{ insert: param, sa-21_odp.01 }}: Has appropriate access authorizations as determined by assigned {{ insert: param, sa-21_odp.02 }} ; and Satisfies the following additional personnel screening criteria: {{ insert: param, sa-21_odp.03 }}.
Last updated: 21 August 2026 07:11 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (6)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-798 | Use of Hard-coded Credentials | 2,000+ | Vetting reduces the chance a developer will deliberately insert hard-coded credentials as a backdoor or unauthorized access mechanism. |
CWE-259 | Use of Hard-coded Password | 100+ | Background checks and authorization requirements decrease the probability that a developer will hard-code passwords for later unauthorized access. |
CWE-506 | Embedded Malicious Code | 99 | Screening developers for trustworthiness and appropriate authorizations directly reduces the likelihood that a malicious insider will intentionally embed malicious code during development. |
CWE-912 | Hidden Functionality | 87 | Personnel screening makes it harder for an attacker to place a developer who will introduce hidden functionality or covert channels. |
CWE-540 | Inclusion of Sensitive Information in Source Code | 31 | Screening helps prevent intentional insertion of sensitive information into source code by untrusted developers. |
CWE-1242 | Inclusion of Undocumented Features or Chicken Bits | 14 | Requiring screened developers with proper access limits the introduction of undocumented features or debug 'chicken bits' that could be exploited later. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
| No CVEs annotated to this control yet — the per-CVE backfill is in progress. | ||||