+SA-09 [H] External System Services
---+SA-09(02) [H] Identification of Functions, Ports, Protocols, and Services

SA-09 [H] External System Services

Control

  1. Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: [Assignement: controls];
  2. Define and document organizational oversight and user roles and responsibilities with regard to external system services; and
  3. Employ the following processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis: [Assignement: processes, methods, and techniques].

Discussion

External system services are provided by an external provider, and the organization has no direct control over the implementation of the required controls or the assessment of control effectiveness. Organizations establish relationships with external service providers in a variety of ways, including through business partnerships, contracts, interagency agreements, lines of business arrangements, licensing agreements, joint ventures, and supply chain exchanges. The responsibility for managing risks from the use of external system services remains with authorizing officials. For services external to organizations, a chain of trust requires that organizations establish and retain a certain level of confidence that each provider in the consumer-provider relationship provides adequate protection for the services rendered. The extent and nature of this chain of trust vary based on relationships between organizations and the external providers. Organizations document the basis for the trust relationships so that the relationships can be monitored. External system services documentation includes government, service providers, end user security roles and responsibilities, and service-level agreements. Service-level agreements define the expectations of performance for implemented controls, describe measurable outcomes, and identify remedies and response requirements for identified instances of noncompliance.

Assessment Objective

    1. providers of external system services comply with organizational security requirements;
    2. providers of external system services comply with organizational privacy requirements;
    3. providers of external system services employ [Assignement: controls];
    1. organizational oversight with regard to external system services are defined and documented;
    2. user roles and responsibilities with regard to external system services are defined and documented;
  3. [Assignement: processes, methods, and techniques] are employed to monitor control compliance by external service providers on an ongoing basis.

Assessment Method

Examine

System and services acquisition policy system and services acquisition procedures procedures addressing methods and techniques for monitoring control compliance by external service providers of system services acquisition documentation contracts service level agreements interagency agreements licensing agreements list of organizational security and privacy requirements for external provider services control assessment results or reports from external providers of system services system security plan privacy plan supply chain risk management plan other relevant documents or records

Interview

Organizational personnel with acquisition responsibilities external providers of system services organizational personnel with information security and privacy responsibilities organizational personnel with supply chain risk management responsibilities

1. Přehled

SA-09(02) [H] Identification of Functions, Ports, Protocols, and Services

Control

Require providers of the following external system services to identify the functions, ports, protocols, and other services required for the use of such services: [Assignement: external system services].

Discussion

Information from external service providers regarding the specific functions, ports, protocols, and services used in the provision of such services can be useful when the need arises to understand the trade-offs involved in restricting certain functions and services or blocking certain ports and protocols.

Assessment Objective

providers of [Assignement: external system services] are required to identify the functions, ports, protocols, and other services required for the use of such services.

Assessment Method

Examine

System and services acquisition policy supply chain risk management policy and procedures procedures addressing external system services acquisition contracts for the system, system component, or system service acquisition documentation solicitation documentation service level agreements organizational security requirements and security specifications for external service providers list of required functions, ports, protocols, and other services system security plan other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities system/network administrators external providers of system services

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
is blocked by SA-09 [H] External System Services – Assessment Procedure
is blocked by Third-Party Services