SA-11(2) Developer Testing and Evaluation | Threat Modeling and Vulnerability Analyses

Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analyses during development and the subsequent testing and evaluation of the system, component, or service that: (a) Uses the following contextual information: organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels; (b) Employs the following tools and methods: organization-defined tools and methods; (c) Conducts the modeling and analyses at the following level of rigor: organization-defined breadth and depth of modeling and analyses; and (d) Produces evidence that meets the following acceptance criteria: organization-defined acceptance criteria.

Source: NIST SP 800-53 Rev 5, SA-11(2). The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open NIST SP 800-53 Rev 5 in the compliance library.

Base controls and their enhancements. Which apply follows the baseline you are assessed against (for example FedRAMP Moderate or High, or the low, moderate and high baselines of SP 800-53B). Text in square brackets is a parameter your organisation sets.