# NIST 800-53 System and Services Acquisition (SA)

Browse NIST 800-53 System and Services Acquisition (SA) controls — manage security in system development and external service acquisition — with implementation guidance and mappings.

* [SA-1: Policy and Procedures](/compliance/nist-sp-800-53/sa/sa-1)
* [SA-2: Allocation of Resources](/compliance/nist-sp-800-53/sa/sa-2)
* [SA-3: System Development Life Cycle](/compliance/nist-sp-800-53/sa/sa-3)
* [SA-4: Acquisition Process](/compliance/nist-sp-800-53/sa/sa-4)
* [SA-5: System Documentation](/compliance/nist-sp-800-53/sa/sa-5)
* [SA-8: Security and Privacy Engineering Principles](/compliance/nist-sp-800-53/sa/sa-8)
* [SA-9: External System Services](/compliance/nist-sp-800-53/sa/sa-9)
* [SA-10: Developer Configuration Management](/compliance/nist-sp-800-53/sa/sa-10)
* [SA-11: Developer Testing and Evaluation](/compliance/nist-sp-800-53/sa/sa-11)
* [SA-15: Development Process, Standards, and Tools](/compliance/nist-sp-800-53/sa/sa-15)
* [SA-16: Developer-provided Training](/compliance/nist-sp-800-53/sa/sa-16)
* [SA-17: Developer Security and Privacy Architecture and Design](/compliance/nist-sp-800-53/sa/sa-17)
* [SA-20: Customized Development of Critical Components](/compliance/nist-sp-800-53/sa/sa-20)
* [SA-21: Developer Screening](/compliance/nist-sp-800-53/sa/sa-21)
* [SA-22: Unsupported System Components](/compliance/nist-sp-800-53/sa/sa-22)
* [SA-23: Specialization](/compliance/nist-sp-800-53/sa/sa-23)
* [SA-24: Design For Cyber Resiliency](/compliance/nist-sp-800-53/sa/sa-24)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)