SA-15(11): Archive Information System / Component

Control Family:

System And Services Acquisition

Parent Control:

SA-15: Development Process, Standards, And Tools

Priority:

P2: Implement P2 security controls after implementation of P1 controls.

CSF v1.1 References:

ID.SC-2
PR.IP-2

Threats Addressed:

Tampering

Baselines:

(Not part of any baseline)

Next Version:

NIST Special Publication 800-53 Revision 5.2.0:
SA-15(11): Archive System or Component

Control Statement

The organization requires the developer of the information system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security review.

Supplemental Guidance

Archiving relevant documentation from the development process can provide a readily available baseline of information that can be helpful during information system/component upgrades or modifications.