NIST 800-53 rev.5/System and Services Acquisition/742 of 1011
SA-21Developer Screening
Control family: System and Services Acquisition
Control description
Require that the developer of [Assignment: organization-defined system, system component, or system service]:
a. Has appropriate access authorizations as determined by assigned [Assignment: organization-defined official government duties]; and
b. Satisfies the following additional personnel screening criteria: [Assignment: organization-defined additional personnel screening criteria].
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.