NIST 800-53 r5 · Controls catalogue · Family SA
SA-3System Development Life Cycle
Acquire, develop, and manage the system using {{ insert: param, sa-03_odp }} that incorporates information security and privacy considerations; Define and document information security and privacy roles and responsibilities throughout the system development life cycle; Identify individuals having information security and privacy roles and responsibilities; and Integrate the organizational information security and privacy risk management process into system development life cycle activities.
Last updated: 15 October 2026 20:36 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 1 mapping(s) from 1 framework(s): OWASP-Web 1 (partial)
Implementations targeting this control (2)
- aws-config-codebuild-project-envvar-awscred-check Codebuild Project Envvar Awscred Check AWS::CodeBuild::Project partial protect enforce
- aws-config-ec2-instance-managed-by-systems-manager Ec2 Instance Managed By Systems Manager AWS::EC2::Instance partial protect enforce
ATT&CK techniques this control mitigates (6)
- T1078 Valid Accounts Stealth, Persistence, Privilege Escalation, Initial Access
- T1078.001 Default Accounts Stealth, Persistence, Privilege Escalation, Initial Access
- T1078.003 Local Accounts Stealth, Persistence, Privilege Escalation, Initial Access
- T1078.004 Cloud Accounts Stealth, Persistence, Privilege Escalation, Initial Access
- T1213.003 Code Repositories Collection
- T1574.001 DLL Stealth, Execution
Weaknesses this control addresses (9)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-862 | Missing Authorization | 11,800+ | Requiring security roles and risk processes throughout the SDLC ensures that authorization checks are identified as requirements and implemented for every sensitive operation. |
CWE-284 | Improper Access Control | 8,100+ | Defining security roles/responsibilities and integrating risk management into the SDLC directly reduces improper access control by ensuring access decisions are designed and reviewed throughout development. |
CWE-287 | Improper Authentication | 5,600+ | Requiring explicit security roles and risk integration in the SDLC forces authentication mechanisms to be planned, documented, and validated instead of omitted or weakly implemented. |
CWE-798 | Use of Hard-coded Credentials | 2,100+ | Integrating risk management and security responsibilities into the SDLC makes use of hard-coded credentials visible during design and code reviews, reducing their introduction. |
CWE-732 | Incorrect Permission Assignment for Critical Resource | 2,000+ | Documented roles, responsibilities, and continuous risk management in the SDLC ensure that default and runtime permissions for critical resources are deliberately assigned and reviewed. |
CWE-285 | Improper Authorization | 1,700+ | Incorporating security considerations and risk management into every SDLC phase ensures authorization logic is properly specified, implemented, and tested rather than added ad hoc. |
CWE-311 | Missing Encryption of Sensitive Data | 500+ | Privacy and security considerations mandated across the SDLC make identification and protection of sensitive data (including encryption decisions) a required activity rather than an afterthought. |
CWE-1104 | Use of Unmaintained Third Party Components | 31 | Acquisition and development under a security-aware SDLC includes evaluation of third-party components for maintenance status and known weaknesses before integration. |
CWE-657 | Violation of Secure Design Principles | 20 | The control explicitly requires adoption of an SDLC that incorporates security considerations, directly preventing violation of established secure design principles. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2026-104252 | 7.5 | 9.8 | 0.0089 | partial |
CVE-2026-59167 | 7.3 | 10.0 | 0.0039 | partial |
CVE-2026-106102 | 7.2 | 10.0 | 0.0030 | partial |
CVE-2026-15639 | 7.0 | 9.3 | 0.0039 | partial |
CVE-2026-91130 | 7.0 | 9.3 | 0.0039 | partial |
CVE-2026-101127 | 7.0 | 9.4 | 0.0033 | partial |
CVE-2026-14911 | 7.0 | 9.3 | 0.0032 | partial |
CVE-2024-36912 UPD | 6.9 | 9.6 | 0.0097 | partial |
CVE-2026-82832 UPD | 6.9 | 9.6 | 0.0062 | partial |
CVE-2025-15480 UPD | 6.8 | 9.1 | 0.0031 | partial |
CVE-2026-85385 | 6.8 | 9.6 | 0.0050 | partial |
CVE-2026-88804 | 6.8 | 9.6 | 0.0060 | partial |
CVE-2026-100133 | 6.8 | 9.3 | 0.0094 | partial |
CVE-2026-70279 | 6.8 | 9.3 | 0.0086 | partial |
CVE-2026-92985 | 6.7 | 8.8 | 0.0082 | partial |
CVE-2026-92986 | 6.7 | 8.8 | 0.0082 | partial |
CVE-2026-93922 | 6.7 | 8.8 | 0.0082 | partial |
CVE-2026-63353 | 6.7 | 9.6 | 0.0041 | partial |
CVE-2026-63354 | 6.7 | 9.6 | 0.0045 | partial |
CVE-2026-91013 | 6.7 | 9.3 | 0.0075 | partial |
CVE-2026-96230 | 6.7 | 8.8 | 0.0078 | partial |
CVE-2026-106629 | 6.7 | 9.3 | 0.0068 | partial |
CVE-2026-106630 | 6.7 | 9.3 | 0.0068 | partial |
CVE-2026-83662 | 6.7 | 9.3 | 0.0072 | partial |
CVE-2024-36913 UPD | 6.6 | 9.3 | 0.0066 | partial |