SA-18, Tamper Resistance and Detection, is withdrawn in NIST SP 800-53 Rev 5. The catalog says it moved to SR-9. Its enhancements were SA-18.1 Multiple Phases of System Development Life Cycle and SA-18.2 Inspection of Systems or Components.
800-53 binds US federal systems, and others by contract. It is a reference for everyone else.
What it means in practice
Tamper resistance is about making it hard to alter a system or component without notice, and tamper detection is about noticing if it happened. The enhancement titles say the idea applies across the life cycle, and that inspection is part of it.
For software teams this is mostly about build and release integrity: signed artifacts, protected branches, and checks that what you shipped is what you built.
Evidence to collect
- Branch protection and review settings.
- Signing or checksum records for releases.
- Inspection records for hardware you receive, if you handle any.
Common gaps
Signing releases but never verifying the signature before deploy.
How to implement it
Cite SR-9 in new documents. Verify artifacts at deploy time and log the result.
What an auditor may ask
They may ask how you know the build you deployed is the one your team reviewed. A good answer names the signing step, the verification step at deploy and the log that records both. They may also ask what happens when verification fails, so write down that the deploy stops and who is told.
Quick check
Is SA-18 still assessed in Rev 5?
No. It was moved to SR-9.
