SA-03 System Development Life Cyclesa-3
Whether an AWS call fetches evidence for this control, and what to run. Its Rev5 baselines, the indicators that reach it and the FedRAMP guidance attached to it open below.
Nothing names itNo recipe names SA-03. 3 reach an indicator it shares, which is adjacency and not coverage — worth reading, not worth recording as evidence for this control.
Collect evidence (0)
Authored pipeline recipes whose output is evidence for SA-03. This mapping is this project’s opinion (overlay v0.8.0), versioned separately from the dataset — the upstream FedRAMP rules name none of these tools.
No authored recipe names SA-03. The nearest authored work is below.
The control asks that the system be acquired and built under a documented lifecycle, with security roles assigned and risk management integrated into each phase. None of those three is a property of the estate: a pipeline execution record names no lifecycle, assigns no role and integrates no risk decision, so it is not partial evidence of any limb — it is evidence of a different thing that happens to run alongside. The lifecycle definition, the role assignments and the phase gates live in the SSP and the acquisition record, and a 3PAO reads them there.
This project’s assessment (automation register v0.9.0, reviewed 2026-08-11), versioned separately from the dataset and from the evidence overlays. It is an opinion about the AWS surface on that date, and the surface moves.
The KSIs that reach it are KSI-PIY-RIS, KSI-PIY-RSD — which is what asks for it. The evidence it asks for is written, not fetched. Browse /collect for the whole authored corpus.
Reaches the same indicator, not SA-03
These recipes prove a KSI that reaches it. None of them claims SA-03 — treat them as neighbours worth reading, not as coverage.
- The rule requiring the designated owners of the changed code to approve before it merges, the file that names who those owners are, the platform's own report of whether that file actually parses — and, per change, who approved, on which commit, and when. via KSI-PIY-RSD
- Which policy decisions were actually enforced against the infrastructure definitions the boundary deploys from: that a policy scan ran, on which branch, how many rules it applied and when it last ran, together with the failures still open and the record of which were dismissed and with what justification. The load-bearing half is the scan record rather than the findings. SA-08 asks whether security engineering principles were applied, and a clean findings list is the same output whether every principle held or the scan applied no rules, ran last quarter, or parsed nothing — so the count of rules run and the date it ran are the part of this evidence that makes the rest of it mean anything. via KSI-PIY-RSD
- For a service that ships code to a browser, the two things a pipeline can say about the mobile code it delivers: what was allowed INTO it, and whether what shipped is what this pipeline built. The first is the dependency diff for the change — every component added, its ecosystem, its version, its licence and any advisory against it, separated by whether it reaches the runtime or stops at the build — and the gate that makes the check mandatory rather than advisory. The second is a provenance attestation over the built bundle, verified against the repository and workflow that are supposed to have produced it. Neither is a statement about which mobile code technologies the organization decided to permit, and that is the control's first limb. via KSI-PIY-RSD
What NIST requires of SA-03
The control statement from NIST 800-53 Rev5, verbatim. Square brackets are organization-defined parameters — yours to set, not FedRAMP's to dictate.
a. Acquire, develop, and manage the system using [system-development life cycle] that incorporates information security and privacy considerations; b. Define and document information security and privacy roles and responsibilities throughout the system development life cycle; c. Identify individuals having information security and privacy roles and responsibilities; and d. Integrate the organizational information security and privacy risk management process into system development life cycle activities.
NIST SP 800-53 Rev5 catalog 5.2.0, from usnistgov/oscal-content at 78650f0. The FedRAMP dataset carries no control text; this is borrowed and pinned.
Rev5 baseline membership
Membership is the whole relationship — a baseline is a set of control ids. Class A carries no baseline at all. The Low/Moderate/High labels are an interpretation from control counts, not a dataset fact.
KSI indicators reaching this control (2)
Under 20x, these indicators are how this control is demonstrated — automated KSI evidence stands in for narrative control evidence.
- PIYKSI-PIY-RISReviewing Investments in Security
The effectiveness of the provider's investments in achieving security goals is persistently reviewed.
- PIYKSI-PIY-RSDReviewing Security in the SDLC
The effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles is persistently reviewed.
Pages exist for the 209 controls reached by at least one KSI. Baseline-only controls are the orphans on /coverage. Control titles and full text live in the NIST catalog, not this dataset.