NIST 800-53 r5 · Controls catalogue · Family SA
SA-3System Development Life Cycle
Acquire, develop, and manage the system using {{ insert: param, sa-03_odp }} that incorporates information security and privacy considerations; Define and document information security and privacy roles and responsibilities throughout the system development life cycle; Identify individuals having information security and privacy roles and responsibilities; and Integrate the organizational information security and privacy risk management process into system development life cycle activities.
Last updated: 22 August 2026 07:11 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 1 mapping(s) from 1 framework(s): OWASP-Web 1 (partial)
Implementations targeting this control (2)
- aws-config-codebuild-project-envvar-awscred-check Codebuild Project Envvar Awscred Check AWS::CodeBuild::Project partial protect enforce
- aws-config-ec2-instance-managed-by-systems-manager Ec2 Instance Managed By Systems Manager AWS::EC2::Instance partial protect enforce
ATT&CK techniques this control mitigates (6)
- T1078 Valid Accounts Stealth, Persistence, Privilege Escalation, Initial Access
- T1078.001 Default Accounts Stealth, Persistence, Privilege Escalation, Initial Access
- T1078.003 Local Accounts Stealth, Persistence, Privilege Escalation, Initial Access
- T1078.004 Cloud Accounts Stealth, Persistence, Privilege Escalation, Initial Access
- T1213.003 Code Repositories Collection
- T1574.001 DLL Stealth, Execution
Weaknesses this control addresses (9)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-862 | Missing Authorization | 10,200+ | Requiring security roles and risk processes throughout the SDLC ensures that authorization checks are identified as requirements and implemented for every sensitive operation. |
CWE-284 | Improper Access Control | 6,900+ | Defining security roles/responsibilities and integrating risk management into the SDLC directly reduces improper access control by ensuring access decisions are designed and reviewed throughout development. |
CWE-287 | Improper Authentication | 5,200+ | Requiring explicit security roles and risk integration in the SDLC forces authentication mechanisms to be planned, documented, and validated instead of omitted or weakly implemented. |
CWE-798 | Use of Hard-coded Credentials | 2,000+ | Integrating risk management and security responsibilities into the SDLC makes use of hard-coded credentials visible during design and code reviews, reducing their introduction. |
CWE-732 | Incorrect Permission Assignment for Critical Resource | 1,900+ | Documented roles, responsibilities, and continuous risk management in the SDLC ensure that default and runtime permissions for critical resources are deliberately assigned and reviewed. |
CWE-285 | Improper Authorization | 1,500+ | Incorporating security considerations and risk management into every SDLC phase ensures authorization logic is properly specified, implemented, and tested rather than added ad hoc. |
CWE-311 | Missing Encryption of Sensitive Data | 500+ | Privacy and security considerations mandated across the SDLC make identification and protection of sensitive data (including encryption decisions) a required activity rather than an afterthought. |
CWE-1104 | Use of Unmaintained Third Party Components | 26 | Acquisition and development under a security-aware SDLC includes evaluation of third-party components for maintenance status and known weaknesses before integration. |
CWE-657 | Violation of Secure Design Principles | 20 | The control explicitly requires adoption of an SDLC that incorporates security considerations, directly preventing violation of established secure design principles. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2024-36912 UPD | 6.9 | 9.6 | 0.0096 | partial |
CVE-2025-15480 UPD | 6.8 | 9.1 | 0.0031 | partial |
CVE-2024-36913 UPD | 6.6 | 9.3 | 0.0065 | partial |
CVE-2025-14551 UPD | 6.0 | 8.1 | 0.0028 | partial |
CVE-2026-66432 | 5.8 | 7.5 | 0.0040 | partial |
CVE-2026-52696 | 5.7 | 7.5 | 0.0024 | partial |
CVE-2025-32257 UPD | 4.6 | 5.3 | 0.0080 | partial |
CVE-2025-26482 UPD | 3.9 | 4.9 | 0.0029 | partial |
CVE-2026-26948 | 3.9 | 4.9 | 0.0029 | partial |
CVE-2024-52289 UPD | 7.5 | 9.8 | 0.0106 | partial |
CVE-2024-52324 | 7.4 | 9.8 | 0.0069 | partial |
CVE-2024-44852 UPD | 7.4 | 9.8 | 0.0059 | partial |
CVE-2025-14233 UPD | 7.4 | 9.8 | 0.0078 | partial |
CVE-2025-55050 UPD | 7.2 | 9.8 | 0.0034 | partial |
CVE-2025-12176 UPD | 7.2 | 9.8 | 0.0032 | partial |
CVE-2026-52993 UPD | 7.2 | 9.8 | 0.0037 | partial |
CVE-2017-20204 UPD | 7.0 | 9.3 | 0.0084 | partial |
CVE-2024-6607 UPD | 6.6 | 8.8 | 0.0056 | partial |
CVE-2025-25215 UPD | 6.6 | 8.8 | 0.0206 | partial |
CVE-2023-3634 | 6.6 | 8.8 | 0.0050 | partial |
CVE-2026-74947 | 6.4 | 8.8 | 0.0024 | partial |
CVE-2024-2955 UPD | 6.1 | 7.8 | 0.0140 | partial |
CVE-2025-48431 UPD | 6.1 | 7.5 | 0.0108 | partial |
CVE-2025-41756 | 6.0 | 8.1 | 0.0033 | partial |
CVE-2024-52564 UPD | 5.9 | 7.5 | 0.0058 | partial |