System and Services Acquisition (SA) 309

SA-1 System and Services Acquisition Policy and Procedures (H) 309

SA-2 Allocation of Resources (L) (M) (H) 310

SA-3 System Development Life Cycle (L) (M) (H) 311

SA-4 Acquisitions Process (L) (M) (H) 312

SA-4 (1) Control Enhancement (M) (H) 313

SA-4 (2) Control Enhancement (H) 314

SA-4 (8) Control Enhancement (M) (H) 315

SA-4 (9) Control Enhancement (M) (H) 315

SA-4 (10) Control Enhancement (M) (H) 316

SA-5 Information System Documentation (H) 317

SA-8 Security Engineering Principles (M) (H) 318

SA-9 External Information System Services (L) (M) (H) 319

SA-9 (1) Control Enhancement (M) (H) 321

SA-9 (2) Control Enhancement (M) (H) 321

SA-9 (4) Control Enhancement (M) (H) 322

SA-9 (5) Control Enhancement (M) (H) 323

SA-10 Developer Configuration Management (M) (H) 324

SA-10 (1) Control Enhancement (M) (H) 325

SA-11 Developer Security Testing and Evaluation (M) (H) 326

SA-11 (1) Control Enhancement (M) (H) 327

SA-11 (2) Control Enhancement (M) (H) 328

SA-11 (8) Control Enhancement (M) (H) 329

SA-12 Supply Chain Protection (H) 330

SA-15 Development Process, Standards, and Tools (H) 331

SA-16 Developer-Provided Training (H) 332

SA-17 Developer Security Architecture and Design (H) 333