{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Secure Development (SDLC) & Application Security","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-SDLC-10","description":"Direct, monitor, and review outsourced and third-party development: contractually define secure-development requirements, intellectual property ownership, and audit rights, review deliverables against requirements, and obtain evidence of security testing. Screen developers of critical systems against defined criteria before granting them access to development environments.","details":{"control_category":"administrative","control_type":"preventive","domain":"Secure Development (SDLC) & Application Security","guidance":[],"members":[{"control_id":"SA-21","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"A.8.30","coverage":"full","framework":"iso-27001","relationship":"superset_of"}],"statement":"Direct, monitor, and review outsourced and third-party development: contractually define secure-development requirements, intellectual property ownership, and audit rights, review deliverables against requirements, and obtain evidence of security testing. Screen developers of critical systems against defined criteria before granting them access to development environments.","title":"Oversee outsourced development and vet developers","unified_id":"UC-SDLC-10"},"id":"uc:UC-SDLC-10","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-SDLC-10","sourceIds":["iso-27001","nist-800-53"],"sourceUrl":null,"title":"UC-SDLC-10 — Oversee outsourced development and vet developers","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0f39056894c4e8d75a18c34a1a3a2322758c2b351a4612749e8cd6c6ae46e301","properties":{"rationale":"Contractual secure-dev requirements, deliverable review and testing evidence oversee third-party AI/component providers.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-10-3ac58852.json","sourceId":"uc:UC-SDLC-10","targetDetailPath":"/data/v1/records/risk-ai-supply-chain-concentration-9f791f54.json","targetId":"risk:ai-supply-chain-concentration","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2b584d7fa6882fb7f2428dfe0803cc7312e35435d88ca21bafcd04a2ffce8477","properties":{"rationale":"Obtaining evidence of security testing for outsourced deliverables ensures third-party code is tested/scanned rather than shipped untested.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-10-3ac58852.json","sourceId":"uc:UC-SDLC-10","targetDetailPath":"/data/v1/records/risk-vuln-inadequate-testing-scanning-ee33b888.json","targetId":"risk:vuln-inadequate-testing-scanning","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4e1cd93f7723a8be13dd62749b43ae61ba121a16b6530347245fb61cc7180721","properties":{},"sourceDetailPath":"/data/v1/records/wf-g13-0f34ff59.json","sourceId":"wf:G13","targetDetailPath":"/data/v1/records/uc-uc-sdlc-10-3ac58852.json","targetId":"uc:UC-SDLC-10","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:517060641444e142182eed9cf5d405933cada7c0a48905fa9d26ccb9f81ec85c","properties":{"rationale":"Reviewing outsourced deliverables against requirements and requiring security-testing evidence reduces vulnerabilities in third-party code.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-10-3ac58852.json","sourceId":"uc:UC-SDLC-10","targetDetailPath":"/data/v1/records/risk-sdlc-vulnerabilities-in-software-10c28b16.json","targetId":"risk:sdlc-vulnerabilities-in-software","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:67f9b6fda2bad91149e6ff0b47bc681670777a40a7075a27e701837f8cfcdde3","properties":{"control_id":"SA-21","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-10-3ac58852.json","sourceId":"uc:UC-SDLC-10","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-sa-21-7f925e35.json","targetId":"ctrl:nist-800-53:SA-21","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7b365c30cf388c546d12b30d632bd26b47409e5a29e2d70b7404f4b1212a89f5","properties":{},"sourceDetailPath":"/data/v1/records/wf-d06-c9616fb8.json","sourceId":"wf:D06","targetDetailPath":"/data/v1/records/uc-uc-sdlc-10-3ac58852.json","targetId":"uc:UC-SDLC-10","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8bc84b54a9a5b7f2570770fd68a2241f8d328291858b704db7324545dfb5904b","properties":{"rationale":"Screening developers of critical systems and reviewing deliverables reduces malicious insertion via outsourced development.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-10-3ac58852.json","sourceId":"uc:UC-SDLC-10","targetDetailPath":"/data/v1/records/risk-tprm-supply-chain-injection-ad1f5937.json","targetId":"risk:tprm-supply-chain-injection","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b78df392b933c68f3c14d3ef4c2af8faf28b2a88601ab2e6d22eda2aa8113e2b","properties":{"control_id":"A.8.30","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-10-3ac58852.json","sourceId":"uc:UC-SDLC-10","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-30-6a684665.json","targetId":"ctrl:iso-27001:A.8.30","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bd0ef5399d4edb6148e25a04bb1f1ca8c4c3319db7a67afa05455666b2c9a29b","properties":{},"sourceDetailPath":"/data/v1/records/wf-c63-6a1e26cb.json","sourceId":"wf:C63","targetDetailPath":"/data/v1/records/uc-uc-sdlc-10-3ac58852.json","targetId":"uc:UC-SDLC-10","type":"operates"}],"schemaVersion":1}