SA-10 Developer Configuration Management
System and Services Acquisition
Description
Require the developer of the system, system component, or system service to: a. Perform configuration management during system, component, or service [Selection (one or more): design; development; implementation; operation; disposal]; b. Document, manage, and control the integrity of changes to [Assignment: organization-defined configuration items under configuration management]; c. Implement only organization-approved changes to the system, component, or service; d. Document approved changes to the system, component, or service and the potential security and privacy impacts of such changes; and e. Track security flaws and flaw resolution within the system, component, or service and report findings to [Assignment: organization-defined personnel].
Supplemental Guidance
Organizations consider the quality and completeness of configuration management activities conducted by developers as direct evidence of applying effective security controls. Controls include protecting the master copies of material used to generate security-relevant portions of the system hardware, software, and firmware from unauthorized modification or destruction. Maintaining the integrity of changes to the system, system component, or system service requires strict configuration control throughout the system development life cycle to track authorized changes and prevent unauthorized changes. The configuration items that are placed under configuration management include the formal model; the functional, high-level, and low-level design specifications; other design data; implementation documentation; source code and hardware schematics; the current running version of the object code; tools for comparing new versions of security-relevant hardware descriptions and source code with previous versions; and test fixtures and documentation. Depending on the mission and business needs of organizations and the nature of the contractual relationships in place, developers may provide configuration management support during the operations and maintenance stage of the system development life cycle.
Changes from Rev 4
Adds 'disposal' to parameter text selections Adds 'privacy' to control text
Enhancements (7)
What NIST adds to this control. Select one to read its statement.
SA-10(01) Software and Firmware Integrity Verification
Require the developer of the system, system component, or system service to enable integrity verification of software and firmware components.
SA-10(02) Alternative Configuration Management Processes
Provide an alternate configuration management process using organizational personnel in the absence of a dedicated developer configuration management team.
SA-10(03) Hardware Integrity Verification
Require the developer of the system, system component, or system service to enable integrity verification of hardware components.
SA-10(04) Trusted Generation
Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of security-relevant hardware descriptions, source code, and object code with previous versions.
SA-10(05) Mapping Integrity for Version Control
Require the developer of the system, system component, or system service to maintain the integrity of the mapping between the master build data describing the current version of security-relevant hardware, software, and firmware and the on-site master copy of the data for the current version.
SA-10(06) Trusted Distribution
Require the developer of the system, system component, or system service to execute procedures for ensuring that security-relevant hardware, software, and firmware updates distributed to the organization are exactly as specified by the master copies.
SA-10(07) Security and Privacy Representatives
Require [Assignment: organization-defined security and privacy representatives] to be included in the [Assignment: organization-defined configuration change management and control process].
Patterns that use this control (6)
Grouped by the emphasis each pattern gives it.
MITRE ATT&CK Techniques (27)
ATT&CK v16.1Techniques mitigated by this control, mapped via CTID.