| SA-11 | System and Services Acquisition | Developer Testing and Evaluation |
| SA-11(1) | System and Services Acquisition | Static Code Analysis |
| SA-11(2) | System and Services Acquisition | Threat Modeling and Vulnerability Analyses |
| SA-11(3) | System and Services Acquisition | Independent Verification of Assessment Plans and Evidence |
| SA-11(4) | System and Services Acquisition | Manual Code Reviews |
| SA-11(5) | System and Services Acquisition | Penetration Testing |
| SA-11(6) | System and Services Acquisition | Attack Surface Reviews |
| SA-11(7) | System and Services Acquisition | Verify Scope of Testing and Evaluation |
| SA-11(8) | System and Services Acquisition | Dynamic Code Analysis |
| SA-11(9) | System and Services Acquisition | Interactive Application Security Testing |
| SA-12 | System and Services Acquisition | Supply Chain Protection |
| SA-12(1) | System and Services Acquisition | Acquisition Strategies / Tools / Methods |
| SA-12(10) | System and Services Acquisition | Validate as Genuine and Not Altered |
| SA-12(11) | System and Services Acquisition | Penetration Testing / Analysis of Elements, Processes, and Actors |
| SA-12(12) | System and Services Acquisition | Inter-organizational Agreements |
| SA-12(13) | System and Services Acquisition | Critical Information System Components |
| SA-12(14) | System and Services Acquisition | Identity and Traceability |
| SA-12(15) | System and Services Acquisition | Processes to Address Weaknesses or Deficiencies |
| SA-12(2) | System and Services Acquisition | Supplier Reviews |
| SA-12(3) | System and Services Acquisition | Trusted Shipping and Warehousing |
| SA-12(4) | System and Services Acquisition | Diversity of Suppliers |
| SA-12(5) | System and Services Acquisition | Limitation of Harm |
| SA-12(6) | System and Services Acquisition | Minimizing Procurement Time |
| SA-12(7) | System and Services Acquisition | Assessments Prior to Selection / Acceptance / Update |
| SA-12(8) | System and Services Acquisition | Use of All-source Intelligence |
| SA-12(9) | System and Services Acquisition | Operations Security |
| SA-13 | System and Services Acquisition | Trustworthiness |
| SA-14 | System and Services Acquisition | Criticality Analysis |
| SA-14(1) | System and Services Acquisition | Critical Components with No Viable Alternative Sourcing |
| SA-15 | System and Services Acquisition | Development Process, Standards, and Tools |
| SA-15(1) | System and Services Acquisition | Quality Metrics |
| SA-15(10) | System and Services Acquisition | Incident Response Plan |
| SA-15(11) | System and Services Acquisition | Archive System or Component |
| SA-15(12) | System and Services Acquisition | Minimize Personally Identifiable Information |
| SA-15(13) | System and Services Acquisition | Logging Syntax |
| SA-15(2) | System and Services Acquisition | Security and Privacy Tracking Tools |
| SA-15(3) | System and Services Acquisition | Criticality Analysis |
| SA-15(4) | System and Services Acquisition | Threat Modeling and Vulnerability Analysis |
| SA-15(5) | System and Services Acquisition | Attack Surface Reduction |
| SA-15(6) | System and Services Acquisition | Continuous Improvement |
| SA-15(7) | System and Services Acquisition | Automated Vulnerability Analysis |
| SA-15(8) | System and Services Acquisition | Reuse of Threat and Vulnerability Information |
| SA-15(9) | System and Services Acquisition | Use of Live Data |
| SA-16 | System and Services Acquisition | Developer-provided Training |
| SA-17 | System and Services Acquisition | Developer Security and Privacy Architecture and Design |
| SA-17(1) | System and Services Acquisition | Formal Policy Model |
| SA-17(2) | System and Services Acquisition | Security-relevant Components |
| SA-17(3) | System and Services Acquisition | Formal Correspondence |
| SA-17(4) | System and Services Acquisition | Informal Correspondence |
| SA-17(5) | System and Services Acquisition | Conceptually Simple Design |