SC.L2-3.13.2
Security Engineering
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee SC.L2-3.13.2 in the reference catalog with its NIST cross-references
Official requirement
Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.
Assessment objectives
a. architectural designs that promote effective information security are identified;
b. software development techniques that promote effective information security are identified;
c. systems engineering principles that promote effective information security are identified;
d. identified architectural designs that promote effective information security are employed;
e. identified software development techniques that promote effective information security are employed; and
f. identified systems engineering principles that promote effective information security are employed.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Use architectural design, software development, and systems engineering principles that promote security.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are responsible for developing strategies to protect data and harden your infrastructure. You are on a team responsible for performing a major upgrade to a legacy system. You refer to your documented security engineering principles [c]. Reviewing each, you decide which are ap propriate and applicable [c]. You apply the chosen designs and principles when creating your design for the upgrade [f]. You document the security requirements for the software and hardware changes to ensure the principles are followed . You review the upgrade at critical points in the workflow to ensure the requirements are met. You assist in updating the policies covering the use of the upgraded system so user behavior stays aligned with the principles.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Security planning policy; procedures addressing system security plan development and implementation; procedures addressing system security plan reviews and updates; enterprise architecture documentation; system security plan; records of system security plan reviews and updates; system and communications protection policy; procedures addressing security engineering principles used in the specification, design, development, implementation, and modification of the system; security architecture documentation; security requirements and specifications for the system; system design documentation; system configuration settings and associated documentation; other relevant documents or records
Common mistakes
Adding security only after system design and development decisions are complete.