SA-24 — Design For Cyber Resiliency

Official NIST control content

Control statement

a.Design organizational systems, system components, or system services to achieve cyber resiliency by:
1. 1.Defining the following cyber resiliency goals: [Organization-defined: cyber resiliency goals].
2. 2.Defining the following cyber resiliency objectives: [Organization-defined: cyber resiliency objectives].
3. 3.Defining the following cyber resiliency techniques: [Organization-defined: cyber resiliency techniques].
4. 4.Defining the following cyber resiliency implementation approaches: [Organization-defined: cyber resiliency implementation approaches].
5. 5.Defining the following cyber resiliency design principles: [Organization-defined: cyber resiliency design principles].
b.Implement the selected cyber resiliency goals, objectives, techniques, implementation approaches, and design principles as part of an organizational risk management process or systems security engineering process.

Official NIST discussion

Discussion

Cyber resiliency is critical to ensuring the survivability of mission critical systems and high value assets. Cyber resiliency focuses on limiting the damage from adversity or the conditions that can cause a loss of assets. Damage can affect: (1) organizations (e.g., loss of reputation, increased existential risk); (2) missions or business functions (e.g., decreased capability to complete current missions and to accomplish future missions); (3) security (e.g., decreased capability to achieve security objectives or to prevent, detect, and respond to cyber incidents); (4) systems (e.g., unauthorized use of system resources or decreased capability to meet system requirements); or (5) specific system elements (e.g., physical destruction; corruption, modification, or fabrication of information). Cyber resiliency goals are intended to help organizations maintain a state of informed preparedness for adversity, continue essential mission or business functions despite adversity, restore mission or business functions during and after adversity, and modify mission or business functions and their supporting capabilities in response to predicted changes in technical, operational, or threat environments. NIST SP 800-160, Volume 2 provides additional information on the Cyber Resiliency Engineering Framework to include detailed descriptions of cyber resiliency goals, objectives, techniques, implementation approaches, and design principles. NIST SP 800-160, Vol 1 provides additional information on achieving cyber resiliency as an emergent property of an engineered system.

Official OSCAL parameters

Organization-defined parameters

These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.

cyber resiliency goalscyber resiliency goals are defined;

cyber resiliency objectivescyber resiliency objectives are defined;

cyber resiliency techniquescyber resiliency techniques are defined;

cyber resiliency implementation approachescyber resiliency implementation approaches are defined;

cyber resiliency design principlescyber resiliency design principles are defined;

Original Bare Metal Cyber perspective

From control text to operational evidence

Use Design For Cyber Resiliency as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to secure acquisition, engineering, development lifecycle, supplier expectations, and system integrity by design.

Implementation workflow

Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
Resolve each organization-defined parameter before declaring the control implemented.
Document how the implementation satisfies every clause of the official control statement.
Collect evidence as a normal byproduct of operation rather than only before an assessment.
Review exceptions, changes, and monitoring results on a risk-based cadence.

Evidence examples

security requirements in contracts and specifications
architecture and design review records
development lifecycle evidence
supplier assessment and acceptance records

Common failure patterns

security requirements added after procurement
supplier claims accepted without evidence
development exceptions become permanent
security architecture not tied to testable requirements

Questions practitioners should ask

What risk decision is this control intended to support in this system?
Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
What event or threshold requires the implementation to be reviewed or changed?

Official NIST SP 800-53A content

Assessment objectives and methods

Show the assessment objective

Determine if:

SA-24a.
1. SA-24a.01organizational systems, system components, or system services achieve cyber resiliency through [Organization-defined: cyber resiliency goals];
2. SA-24a.02organizational systems, system components, or system services achieve cyber resiliency through [Organization-defined: cyber resiliency objectives];
3. SA-24a.03organizational systems, system components, or system services achieve cyber resiliency through [Organization-defined: cyber resiliency techniques];
4. SA-24a.04organizational systems, system components, or system services achieve cyber resiliency through [Organization-defined: cyber resiliency implementation approaches];
5. SA-24a.05organizational systems, system components, or system services achieve cyber resiliency through [Organization-defined: cyber resiliency design principles];
SA-24b.
1. SA-24b.[01]selected cyber resiliency goals are implemented as part of an organizational risk management process of systems security engineering process;
2. SA-24b.[02]selected cyber resiliency objectives are implemented as part of an organizational risk management process of systems security engineering process;
3. SA-24b.[03]selected cyber resiliency techniques are implemented as part of an organizational risk management process of systems security engineering process;
4. SA-24b.[04]selected cyber resiliency implementation approaches are implemented as part of an organizational risk management process of systems security engineering process;
5. SA-24b.[05]selected cyber resiliency design principles are implemented as part of an organizational risk management process of systems security engineering process.

Examine

System and services acquisition policy;
system and services acquisition procedures;
assessment and authorization procedures;
procedures addressing cyber resiliency goals, objectives, techniques, implementation approaches, and design principles used in the specification, design, development, implementation, and modification of the system;
system design documentation;
security and privacy requirements and specifications for the system;
system security plan;
privacy plan;
privacy impact assessment;
privacy risk assessment documentation.

Interview

Organizational personnel with acquisition/contracting responsibilities;
organizational personnel with information security and privacy responsibilities;
organizational personnel with system specification, design, development, implementation, and modification responsibilities;
system developers.

Test

Organizational processes for applying cyber resiliency principles in system specification, design, development, implementation, and modification;
mechanisms supporting the application of cyber resiliency principles in system specification, design, development, implementation, and modification.

Official relationships

Related controls

These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.

Source record

Authoritative sources

Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.