NIST 800-53 rev.5/System and Services Acquisition/722 of 1011
SA-15 (03)Development Process, Standards, and Tools | Criticality Analysis
Control family: System and Services Acquisition
Control description
Require the developer of the system, system component, or system service to perform a criticality analysis:
(a) At the following decision points in the system development life cycle: [Assignment: organization-defined decision points in the system development life cycle]; and
(b) At the following level of rigor: [Assignment: organization-defined breadth and depth of criticality analysis].
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.