SA-10 - Developer Configuration Management

Control requirements

The organization requires the developer of the information system, system component, or information system service to:

SA-10 (a): Perform configuration management during system, component, or service [IBM Assignment: development, implementation, AND operation];
SA-10 (b): Document, manage, and control the integrity of changes to [Assignment: organization-defined configuration items under configuration management];
SA-10 (c): Implement only organization-approved changes to the system, component, or service;
SA-10 (d): Document approved changes to the system, component, or service and the potential security impacts of such changes; and
SA-10 (e): Track security flaws and flaw resolution within the system, component, or service and report findings to [Assignment: organization-defined personnel].

Additional IBM Cloud for Financial Services specifications

The organization shall ensure that changes to customer data are subject to change control per customer requirements. Changes of any type should be communicated to the customer as they arise.

Implementation guidance

See the resources that follow to learn more about how to implement this control.

Development processes and software integrity

IBM Cloud for Financial Services profile

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in IBM Cloud® Security and Compliance Center.

Rules for SA-10 in IBM Cloud for Financial Services v1.2.0 profile
Requirement ID	Rules
SA-10 (a)	Check whether DevSecOps Toolchain collects software bills of materials (SBOM) to provide transparency in build artifacts Check whether DevSecOps Toolchain deployment has approved change documentation including security impact analysis
SA-10 (b)	Check whether DevSecOps Toolchain verifies source code branch protection rules to enforce security policies Check whether DevSecOps Toolchain collects software bills of materials (SBOM) to provide transparency in build artifacts Check whether DevSecOps Toolchain signs build artifacts to attest their provenance Check whether DevSecOps Toolchain deployment has approved change documentation including security impact analysis
SA-10 (c)	Check whether DevSecOps Toolchain signs build artifacts to attest their provenance Check whether DevSecOps Toolchain deployment has approved change documentation including security impact analysis
SA-10 (d)	Check whether DevSecOps Toolchain deployment has approved change documentation including security impact analysis
SA-10 (e)	Check whether DevSecOps Toolchain scans build artifacts to identify vulnerabilities Check whether DevSecOps Toolchain verifies source code branch protection rules to enforce security policies Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely Check whether DevSecOps Toolchain passes dynamic code scan to identify vulnerabilities in deployed artifacts Check whether DevSecOps Toolchain scans source code and their dependencies to identify vulnerabilities Check whether DevSecOps Toolchain source code contains no secrets Check whether DevSecOps Toolchain passes static code scan to identify vulnerabilities in source code

NIST supplemental guidance

This control also applies to organizations conducting internal information systems development and integration. Organizations consider the quality and completeness of the configuration management activities conducted by developers as evidence of applying effective security safeguards. Safeguards include, for example, protecting from unauthorized modification or destruction, the master copies of all material used to generate security-relevant portions of the system hardware, software, and firmware. Maintaining the integrity of changes to the information system, information system component, or information system service requires configuration control throughout the system development life cycle to track authorized changes and prevent unauthorized changes. Configuration items that are placed under configuration management (if existence/use is required by other security controls) include: the formal model; the functional, high-level, and low-level design specifications; other design data; implementation documentation; source code and hardware schematics; the running version of the object code; tools for comparing new versions of security-relevant hardware descriptions and software/firmware source code with previous versions; and test fixtures and documentation. Depending on the mission/business needs of organizations and the nature of the contractual relationships in place, developers may provide configuration management support during the operations and maintenance phases of the life cycle.