Threat Modeling and Vulnerability Analyses
High Risk
Complex
High Cost
SA-11(2) (Threat Modeling and Vulnerability Analyses) enhances base SA-11 within the NIST System and Services Acquisition family. Base SA-11 sets the foundational expectation; this enhancement adds specificity: Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analyses during development and the subsequent testing and evaluation of the system, component, or service that: Uses the following contextual information: [organization-defined]; Em. Covered entities and business associates apply it to system acquisition, SDLC, developer testing, supply chain, and engineering principles for EHR, interfaces, and clinical SaaS.
Control Objective
Implement Threat Modeling and Vulnerability Analyses so acquisition, development, and engineering safeguards operate consistently on systems handling ePHI, with measurable evidence for HIPAA and NIST assessments.
Implementation Guidance
- Map SA-11(2) to in-scope acquired/built systems (EHR, imaging, lab, pharmacy, billing, portals, interfaces, identity).\n2. Translate “Threat Modeling and Vulnerability Analyses” into contract clauses, SDLC gates, architecture patterns, or verification steps with named owners.\n3. Prefer enforceable pipeline and configuration controls over checklist-only assurances where feasible.\n4. Include BA/OEM obligations and evidence deliverables when vendors develop or host ePHI components.\n5. Integrate with change, release, and incident processes so clinical go-lives do not bypass the enhancement.\n6. Retain design packages, test results, SBOMs, and tickets as audit evidence.\n7. Re-validate after major version upgrades — vendors often reset secure defaults.\n8. Review exceptions quarterly; expire “temporary” acquisition waivers that leave ePHI exposed.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Best Practices
- Name an owner for SA-11(2) in the SSP / acquisition control matrix.\n- Put security and privacy requirements in RFPs and BA agreements before award.\n- Measure coverage: percent of ePHI systems where the enhancement’s gates actually run.\n- Keep a one-page evidence pack (design excerpt + test sample + last review) ready.\n- Map withdrawn SA-12 intent to SR-family controls when using Rev. 5 baselines.\n- Re-test after EHR and interface platform upgrades.
Common Gaps & Violations
- Policy cites SA-11(2) but builds/procurements of ePHI systems show no enforcement of threat modeling and vulnerability analyses.\n- Vendors self-attest without artifacts (tests, SBOMs, design docs).\n- Clinical systems and interfaces excluded “because the OEM manages security.”\n- Permanent acquisition waivers with no residual-risk acceptance.\n- Title left as placeholder (“Enhanced …”) with empty use cases.
Required Documentation
- Procedure/standard for Threat Modeling and Vulnerability Analyses (SA-11(2))\n- RFP/contract security exhibits and BA terms\n- SDLC gate definitions and sample evidence\n- Architecture or SBOM / integrity verification records as applicable\n- Exception register with owners and expiry
How to Test & Validate
- Sample a recent acquisition or release touching ePHI; verify threat modeling and vulnerability analyses evidence exists.\n2. Confirm a failed gate or finding actually blocked or delayed promotion.\n3. Interview vendor manager for BA deliverables tied to this enhancement.\n4. Check that clinical interfaces and portals are in scope — not only corporate IT apps.\n5. For SA-12 entries, verify mapping to active SR controls in the SSP.
Audit Considerations
Assessors look for operating proof of Threat Modeling and Vulnerability Analyses on acquired or developed systems with ePHI — contracts, pipeline evidence, design packages, and test artifacts — not only a NIST citation for SA-11(2).
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.308(a)(1)(ii)(B) Risk Management — acquisition and development choices reduce residual risk to ePHI.\n- 164.308(a)(8) Evaluation — technical and nontechnical evaluations include systems acquired or developed for ePHI.\n- 164.314(a) Business Associate Contracts — vendors developing or hosting ePHI systems must meet security requirements.\n- 164.312(a)–(e) Technical Safeguards — acquired systems must support access, audit, integrity, auth, and transmission controls.
Compliance Tips
- List SA-11(2) in the SSP with system inventory and BA references.\n- Prioritize EHR, identity, imaging, and external connections first.\n- Bundle evidence with HIPAA evaluation (§164.308(a)(8)) and BA oversight narratives.
References & Resources
- NIST SP 800-53 Rev. 5 — SA-11(2)\n- Related controls: SA-11, PM-15, RA-3, RA-5
Related Guidelines
Related controls that commonly accompany SA-11(2).
Need Help Implementing SA-11(2)?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.