SA-11 Developer Testing and Evaluation
System and Services Acquisition
Description
Require the developer of the system, system component, or system service, at all post-design stages of the system development life cycle, to: a. Develop and implement a plan for ongoing security and privacy control assessments; b. Perform [Selection (one or more): unit; integration; system; regression] testing/evaluation [Assignment: organization-defined frequency] at [Assignment: organization-defined depth and coverage]; c. Produce evidence of the execution of the assessment plan and the results of the testing and evaluation; d. Implement a verifiable flaw remediation process; and e. Correct flaws identified during testing and evaluation.
Supplemental Guidance
Developmental testing and evaluation confirms that the required controls are implemented correctly, operating as intended, enforcing the desired security and privacy policies, and meeting established security and privacy requirements. Security properties of systems and the privacy of individuals may be affected by the interconnection of system components or changes to those components. The interconnections or changes—including upgrading or replacing applications, operating systems, and firmware—may adversely affect previously implemented controls. Ongoing assessment during development allows for additional types of testing and evaluation that developers can conduct to reduce or eliminate potential flaws. Testing custom software applications may require approaches such as manual code review, security architecture review, and penetration testing, as well as and static analysis, dynamic analysis, binary analysis, or a hybrid of the three analysis approaches. Developers can use the analysis approaches, along with security instrumentation and fuzzing, in a variety of tools and in source code reviews. The security and privacy assessment plans include the specific activities that developers plan to carry out, including the types of analyses, testing, evaluation, and reviews of software and firmware components; the degree of rigor to be applied; the frequency of the ongoing testing and evaluation; and the types of artifacts produced during those processes. The depth of testing and evaluation refers to the rigor and level of detail associated with the assessment process. The coverage of testing and evaluation refers to the scope (i.e., number and type) of the artifacts included in the assessment process. Contracts specify the acceptance criteria for security and privacy assessment plans, flaw remediation processes, and the evidence that the plans and processes have been diligently applied. Methods for reviewing and protecting assessment plans, evidence, and documentation are commensurate with the security category or classification level of the system. Contracts may specify protection requirements for documentation.
Changes from Rev 4
Title changed from 'Developer Security Testing and Evaluation' Control text adds 'ongoing' and 'privacy' New parameter to specify frequency Discussion expanded to include privacy considerations
Enhancements (9)
What NIST adds to this control. Select one to read its statement.
SA-11(01) Static Code Analysis
Require the developer of the system, system component, or system service to employ static code analysis tools to identify common flaws and document the results of the analysis.
SA-11(02) Threat Modeling and Vulnerability Analyses
Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analyses during development and the subsequent testing and evaluation of the system, component, or service that: a. Uses the following contextual information: [Assignment: organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels]; b. Employs the following tools and methods: [Assignment: organization-defined tools and methods]; c. Conducts the modeling and analyses at the following level of rigor: [Assignment: organization-defined breadth and depth of modeling and analyses]; and d. Produces evidence that meets the following acceptance criteria: [Assignment: organization-defined acceptance criteria].
SA-11(03) Independent Verification of Assessment Plans and Evidence
a. Require an independent agent satisfying [Assignment: organization-defined independence criteria] to verify the correct implementation of the developer security and privacy assessment plans and the evidence produced during testing and evaluation; and b. Verify that the independent agent is provided with sufficient information to complete the verification process or granted the authority to obtain such information.
SA-11(04) Manual Code Reviews
Require the developer of the system, system component, or system service to perform a manual code review of [Assignment: organization-defined specific code] using the following processes, procedures, and/or techniques: [Assignment: organization-defined processes, procedures, and/or techniques].
SA-11(05) Penetration Testing
Require the developer of the system, system component, or system service to perform penetration testing: a. At the following level of rigor: [Assignment: organization-defined breadth and depth of testing]; and b. Under the following constraints: [Assignment: organization-defined constraints].
SA-11(06) Attack Surface Reviews
Require the developer of the system, system component, or system service to perform attack surface reviews.
SA-11(07) Verify Scope of Testing and Evaluation
Require the developer of the system, system component, or system service to verify that the scope of testing and evaluation provides complete coverage of the required controls at the following level of rigor: [Assignment: organization-defined breadth and depth of testing and evaluation].
SA-11(08) Dynamic Code Analysis
Require the developer of the system, system component, or system service to employ dynamic code analysis tools to identify common flaws and document the results of the analysis.
SA-11(09) Interactive Application Security Testing
Require the developer of the system, system component, or system service to employ interactive application security testing tools to identify flaws and document the results.
Patterns that use this control (16)
Grouped by the emphasis each pattern gives it.
Critical (7)
- SP-012 Secure Software Development Lifecycle
- SP-028 Secure DevOps Pipeline Pattern
- SP-045 AI Governance and Responsible AI
- SP-049 AI in Security Operations (draft)
- SP-051 Tokenised Asset Security Architecture (draft)
- SP-053 Zero-Knowledge Proof Architecture (draft)
- SP-054 CBDC and Digital Currency Infrastructure (draft)
Important (8)
- SP-011 Cloud Computing Pattern
- SP-027 Secure LLM Usage
- SP-030 API Security
- SP-035 Offensive Security Testing
- SP-047 Secure Agentic AI Frameworks
- SP-048 Offensive AI and Deepfake Defence (draft)
- SP-050 Mobile Security Architecture (draft)
- SP-052 Decentralised Identity & Verifiable Credentials (draft)
Standard (1)
MITRE ATT&CK Techniques (34)
ATT&CK v16.1Techniques mitigated by this control, mapped via CTID.