SA-3—System Development Life Cycle

Acquire, develop, and manage the system using ⚙organization-defined system development life cycle that incorporates information security and privacy considerations;

Define and document information security and privacy roles and responsibilities throughout the system development life cycle;

Identify individuals having information security and privacy roles and responsibilities; and

Integrate the organizational information security and privacy risk management process into system development life cycle activities.