Template:Cybersecurity/System and services acquisition
SA-1 System and services acquisition policy and procedures
This control recommends the organization develop, document, disseminate, review, and update system and services acquisition policies and procedures. It asks organizations to not only address the purpose, scope, roles, responsibilities, and enforcement of system and services acquisition action but also to address how those policies and procedures will be implemented, reviewed, and updated.
Additional resources:
- NIST Special Publications 800-12, Rev. 1, page 69
- NIST Special Publication 800-100, pages 113–23
- LIMSpec 7.1, 7.2
SA-2 Allocation of resources
This control recommends the organization determine, document, and allocate the resources required to protect the information system and its service as part of business process planning, capital planning, and cybersecurity planning. Those associated plans should have a discrete line item pertaining to information security.
Additional resources:
- Integrity Matters Why CPIC Matters More than Ever to Cybersecurity
- No LIMSpec comp (organizational policy rather than system specification)
SA-3 System development lifecycle
This control recommends the organization use a system development life cycle in the management of its information system. As part of this approach, the organization should define and document security roles and responsibilities for the phases of the life cycle, identify the key individuals involved, and ensure the organization's security risk management process is integrated into development life cycle activities. As such, the development life cycle benefits from consistency "with organizational risk management and information security strategies."
Additional resources:
- NIST Special Publications 800-37, Rev. 1
- No LIMSpec comp (organizational policy rather than system specification)
SA-4 Acquisition process
This control recommends the organization, as part of the acquisition process, include security functional, strength, and assurance requirements; requirements for security documentation and its protection; description of the developmental and operational system environments; and acceptance criteria in the acquisition contracts for the information system, its components, and its services.
Additional resources:
- National Information Assurance Partnership
- NIST Special Publication 800-70, Rev. 4
- No LIMSpec comp (organizational policy rather than system specification)
SA-4 (1) Acquisition process: Functional properties of security controls
This control enhancement recommends the organization require of an information system, system component, or software developer a description of the functional properties of the security controls (i.e., the functionality visible at the interfaces of the security controls) the system, component, or software will employ.
Additional resources:
SA-4 (2) Acquisition process: Design and implementation information for security controls
This control enhancement recommends the organization require of an information system, system component, or software developer information on the design and implementation of the security controls inherent to the system, component, or software. This could include security-relevant external system interfaces, high-level design, low-level design, source code, or hardware schematics.
Additional resources:
SA-4 (3) Acquisition process: Development methods, techniques, and practices
This control enhancement recommends the organization require of an information system, system component, or software developer proof of using a development life cycle that includes current and relevant system and security engineering methods, software development methods, testing and validation techniques, and quality control procedures.
Additional resources:
SA-5 Information system documentation
This control recommends the organization require of an information system, system component, or software developer administrator documentation that describes configuration, installation, and operation; effective use and maintenance of security mechanisms; known vulnerabilities of privileged functions; best user practices to ensure system security; and administrator and user responsibilities for maintaining the security. The organization should document any attempts (and failures) to acquire such administrator documentation, protect that documentation internally, and distribute it to the appropriate personnel or roles.
Additional resources:
SA-9 External information system services
This control recommends the organization hold providers of external information system services accountable to organizational security requirements, as well as defined security controls. The organization should also document government oversight and user roles and responsibilities associated with the services. The organization should also monitor the external information system services provider for compliance with organizational security requirements and security controls.
Additional resources:
- No LIMSpec comp (organizational policy rather than system specification)
SA-16 Developer-provided training
This control recommends the organization require of an information system, system component, or software developer specific training on the correct operation of the security functions, controls, and mechanisms of the system, system component, or software.
Additional resources:
