SA-13, Trustworthiness, is withdrawn in NIST SP 800-53 Rev 5. The catalog marks it as incorporated into SA-8, Security and Privacy Engineering Principles. It has no statement and no enhancements of its own.
800-53 binds US federal systems and, by contract, some other organizations. Everyone else can treat it as a reference.
What it means in practice
Do not build a program around SA-13. If a customer questionnaire or an older document cites it, answer with your SA-8 material: how you apply security engineering principles when you design and change systems, and how you decide which components deserve extra scrutiny.
Evidence to collect
- Design documents that show security principles applied, such as layered protections.
- Architecture review notes for components that carry high trust.
Common gaps
Citing a withdrawn control number in a policy, which tells an auditor the document was not kept current.
How to implement it
Replace SA-13 references with SA-8. Mappings to other frameworks vary, so check the one your auditor uses.
What an auditor may ask
A reviewer who sees SA-13 in an old questionnaire will usually accept an answer that points to SA-8. Say which engineering principles you follow, show one design review where they applied, and note that the standalone control no longer exists in Rev 5. Keep the answer short and dated.
Quick check
Can you be assessed against SA-13 in Rev 5?
No. It is withdrawn. Use SA-8 for the related work.
