+SA [P] System and Services Acquisition
---+SA-01 [P] Policy and Procedures
---+SA-02 [P] Allocation of Resources
---+SA-03 [P] System Development Life Cycle
---+SA-04 [P] Acquisition Process
---+SA-08(33) [P] Minimization
---+SA-09 [P] External System Services
---+SA-11 [P] Developer Testing and Evaluation

SA [P] System and Services Acquisition

System and Services Acquisition

1. Přehled

SA-01 [P] Policy and Procedures

Control

  1. Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
    1. [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and services acquisition policy that:
      1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
      2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
    2. Procedures to facilitate the implementation of the system and services acquisition policy and the associated system and services acquisition controls;
  2. Designate an [Assignement: official] to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures; and
  3. Review and update the current system and services acquisition:
    1. Policy [Assignement: frequency] and following [Assignement: events] ; and
    2. Procedures [Assignement: frequency] and following [Assignement: events].

Discussion

System and services acquisition policy and procedures address the controls in the SA family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of system and services acquisition policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to system and services acquisition policy and procedures include assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.

Assessment Objective

    1. a system and services acquisition policy is developed and documented;
    2. the system and services acquisition policy is disseminated to [Assignement: personnel or roles];
    3. system and services acquisition procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls are developed and documented;
    4. the system and services acquisition procedures are disseminated to [Assignement: personnel or roles];
        1. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses purpose;
        2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses scope;
        3. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses roles;
        4. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses responsibilities;
        5. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses management commitment;
        6. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses coordination among organizational entities;
        7. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses compliance;
      2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and services acquisition policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
  2. the [Assignement: official] is designated to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures;
      1. the system and services acquisition policy is reviewed and updated [Assignement: frequency];
      2. the current system and services acquisition policy is reviewed and updated following [Assignement: events];
      1. the current system and services acquisition procedures are reviewed and updated [Assignement: frequency];
      2. the current system and services acquisition procedures are reviewed and updated following [Assignement: events].

Assessment Method

Examine

System and services acquisition policy system and services acquisition procedures supply chain risk management policy supply chain risk management procedures supply chain risk management plan system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with system and services acquisition responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with supply chain risk management responsibilities
SA-02 [P] Allocation of Resources

Control

  1. Determine the high-level information security and privacy requirements for the system or system service in mission and business process planning;
  2. Determine, document, and allocate the resources required to protect the system or system service as part of the organizational capital planning and investment control process; and
  3. Establish a discrete line item for information security and privacy in organizational programming and budgeting documentation.

Discussion

Resource allocation for information security and privacy includes funding for system and services acquisition, sustainment, and supply chain-related risks throughout the system development life cycle.

Assessment Objective

    1. the high-level information security requirements for the system or system service are determined in mission and business process planning;
    2. the high-level privacy requirements for the system or system service are determined in mission and business process planning;
    1. the resources required to protect the system or system service are determined and documented as part of the organizational capital planning and investment control process;
    2. the resources required to protect the system or system service are allocated as part of the organizational capital planning and investment control process;
    1. a discrete line item for information security is established in organizational programming and budgeting documentation;
    2. a discrete line item for privacy is established in organizational programming and budgeting documentation.

Assessment Method

Examine

System and services acquisition policy system and services acquisition procedures system and services acquisition strategy and plans procedures addressing the allocation of resources to information security and privacy requirements procedures addressing capital planning and investment control organizational programming and budgeting documentation system security plan privacy plan supply chain risk management policy other relevant documents or records

Interview

Organizational personnel with capital planning, investment control, organizational programming, and budgeting responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with supply chain risk management responsibilities
SA-03 [P] System Development Life Cycle

Control

  1. Acquire, develop, and manage the system using [Assignement: system-development life cycle] that incorporates information security and privacy considerations;
  2. Define and document information security and privacy roles and responsibilities throughout the system development life cycle;
  3. Identify individuals having information security and privacy roles and responsibilities; and
  4. Integrate the organizational information security and privacy risk management process into system development life cycle activities.

Discussion

A system development life cycle process provides the foundation for the successful development, implementation, and operation of organizational systems. The integration of security and privacy considerations early in the system development life cycle is a foundational principle of systems security engineering and privacy engineering. To apply the required controls within the system development life cycle requires a basic understanding of information security and privacy, threats, vulnerabilities, adverse impacts, and risk to critical mission and business functions. The security engineering principles in [SA-8](#sa-8) help individuals properly design, code, and test systems and system components. Organizations include qualified personnel (e.g., senior agency information security officers, senior agency officials for privacy, security and privacy architects, and security and privacy engineers) in system development life cycle processes to ensure that established security and privacy requirements are incorporated into organizational systems. Role-based security and privacy training programs can ensure that individuals with key security and privacy roles and responsibilities have the experience, skills, and expertise to conduct assigned system development life cycle activities. The effective integration of security and privacy requirements into enterprise architecture also helps to ensure that important security and privacy considerations are addressed throughout the system life cycle and that those considerations are directly related to organizational mission and business processes. This process also facilitates the integration of the information security and privacy architectures into the enterprise architecture, consistent with the risk management strategy of the organization. Because the system development life cycle involves multiple organizations, (e.g., external suppliers, developers, integrators, service providers), acquisition and supply chain risk management functions and controls play significant roles in the effective management of the system during the life cycle.

Assessment Objective

    1. the system is acquired, developed, and managed using [Assignement: system-development life cycle] that incorporates information security considerations;
    2. the system is acquired, developed, and managed using [Assignement: system-development life cycle] that incorporates privacy considerations;
    1. information security roles and responsibilities are defined and documented throughout the system development life cycle;
    2. privacy roles and responsibilities are defined and documented throughout the system development life cycle;
    1. individuals with information security roles and responsibilities are identified;
    2. individuals with privacy roles and responsibilities are identified;
    1. organizational information security risk management processes are integrated into system development life cycle activities;
    2. organizational privacy risk management processes are integrated into system development life cycle activities.

Assessment Method

Examine

System and services acquisition policy system and services acquisition procedures procedures addressing the integration of information security and privacy and supply chain risk management into the system development life cycle process system development life cycle documentation organizational risk management strategy information security and privacy risk management strategy documentation system security plan privacy plan privacy program plan enterprise architecture documentation role-based security and privacy training program documentation data mapping documentation other relevant documents or records

Interview

Organizational personnel with information security and privacy responsibilities organizational personnel with system life cycle development responsibilities organizational personnel with supply chain risk management responsibilities
SA-04 [P] Acquisition Process

Control

Include the following requirements, descriptions, and criteria, explicitly or by reference, using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service:
  1. Security and privacy functional requirements;
  2. Strength of mechanism requirements;
  3. Security and privacy assurance requirements;
  4. Controls needed to satisfy the security and privacy requirements.
  5. Security and privacy documentation requirements;
  6. Requirements for protecting security and privacy documentation;
  7. Description of the system development environment and environment in which the system is intended to operate;
  8. Allocation of responsibility or identification of parties responsible for information security, privacy, and supply chain risk management; and
  9. Acceptance criteria.

Discussion

Security and privacy functional requirements are typically derived from the high-level security and privacy requirements described in [SA-2](#sa-2) . The derived requirements include security and privacy capabilities, functions, and mechanisms. Strength requirements associated with such capabilities, functions, and mechanisms include degree of correctness, completeness, resistance to tampering or bypass, and resistance to direct attack. Assurance requirements include development processes, procedures, and methodologies as well as the evidence from development and assessment activities that provide grounds for confidence that the required functionality is implemented and possesses the required strength of mechanism. [SP 800-160-1](#e3cc0520-a366-4fc9-abc2-5272db7e3564) describes the process of requirements engineering as part of the system development life cycle. Controls can be viewed as descriptions of the safeguards and protection capabilities appropriate for achieving the particular security and privacy objectives of the organization and for reflecting the security and privacy requirements of stakeholders. Controls are selected and implemented in order to satisfy system requirements and include developer and organizational responsibilities. Controls can include technical, administrative, and physical aspects. In some cases, the selection and implementation of a control may necessitate additional specification by the organization in the form of derived requirements or instantiated control parameter values. The derived requirements and control parameter values may be necessary to provide the appropriate level of implementation detail for controls within the system development life cycle. Security and privacy documentation requirements address all stages of the system development life cycle. Documentation provides user and administrator guidance for the implementation and operation of controls. The level of detail required in such documentation is based on the security categorization or classification level of the system and the degree to which organizations depend on the capabilities, functions, or mechanisms to meet risk response expectations. Requirements can include mandated configuration settings that specify allowed functions, ports, protocols, and services. Acceptance criteria for systems, system components, and system services are defined in the same manner as the criteria for any organizational acquisition or procurement. Organizations can determine other requirements that support security and operations, to include responsibilities for the organization and developer, and notification and timing requirements for support, maintenance and updates.

Assessment Objective

    1. security functional requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
    2. privacy functional requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
  2. strength of mechanism requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
    1. security assurance requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
    2. privacy assurance requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
    1. controls needed to satisfy the security requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
    2. controls needed to satisfy the privacy requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
    1. security documentation requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
    2. privacy documentation requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
    1. requirements for protecting security documentation, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
    2. requirements for protecting privacy documentation, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
  7. the description of the system development environment and environment in which the system is intended to operate, requirements, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
    1. the allocation of responsibility or identification of parties responsible for information security requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
    2. the allocation of responsibility or identification of parties responsible for privacy requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ];
    3. the allocation of responsibility or identification of parties responsible for supply chain risk management requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ];
  9. acceptance criteria requirements and descriptions are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service.

Assessment Method

Examine

System and services acquisition policy system and services acquisition procedures procedures addressing the integration of information security and privacy and supply chain risk management into the acquisition process configuration management plan acquisition contracts for the system, system component, or system service system design documentation system security plan supply chain risk management plan privacy plan other relevant documents or records

Interview

Organizational personnel with acquisition/contracting responsibilities organizational personnel with information security and privacy responsibilities system/network administrators organizational personnel with supply chain risk management responsibilities
SA-08(33) [P] Minimization

Control

Implement the privacy principle of minimization using [Assignement: processes].

Discussion

The principle of minimization states that organizations should only process personally identifiable information that is directly relevant and necessary to accomplish an authorized purpose and should only maintain personally identifiable information for as long as is necessary to accomplish the purpose. Organizations have processes in place, consistent with applicable laws and policies, to implement the principle of minimization.

Assessment Objective

the privacy principle of minimization is implemented using [Assignement: processes].

Assessment Method

Examine

System and services acquisition policy system and services acquisition procedures personally identifiable information processing policy procedures addressing the minimization of personally identifiable information in system design system design documentation system configuration settings and associated documentation change control records information security and privacy requirements and specifications for the system system security and privacy architecture system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records

Interview

Organizational personnel with information security and privacy responsibilities organizational personnel with system specification, design, development, implementation, and modification responsibilities system developers
SA-09 [P] External System Services

Control

  1. Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: [Assignement: controls];
  2. Define and document organizational oversight and user roles and responsibilities with regard to external system services; and
  3. Employ the following processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis: [Assignement: processes, methods, and techniques].

Discussion

External system services are provided by an external provider, and the organization has no direct control over the implementation of the required controls or the assessment of control effectiveness. Organizations establish relationships with external service providers in a variety of ways, including through business partnerships, contracts, interagency agreements, lines of business arrangements, licensing agreements, joint ventures, and supply chain exchanges. The responsibility for managing risks from the use of external system services remains with authorizing officials. For services external to organizations, a chain of trust requires that organizations establish and retain a certain level of confidence that each provider in the consumer-provider relationship provides adequate protection for the services rendered. The extent and nature of this chain of trust vary based on relationships between organizations and the external providers. Organizations document the basis for the trust relationships so that the relationships can be monitored. External system services documentation includes government, service providers, end user security roles and responsibilities, and service-level agreements. Service-level agreements define the expectations of performance for implemented controls, describe measurable outcomes, and identify remedies and response requirements for identified instances of noncompliance.

Assessment Objective

    1. providers of external system services comply with organizational security requirements;
    2. providers of external system services comply with organizational privacy requirements;
    3. providers of external system services employ [Assignement: controls];
    1. organizational oversight with regard to external system services are defined and documented;
    2. user roles and responsibilities with regard to external system services are defined and documented;
  3. [Assignement: processes, methods, and techniques] are employed to monitor control compliance by external service providers on an ongoing basis.

Assessment Method

Examine

System and services acquisition policy system and services acquisition procedures procedures addressing methods and techniques for monitoring control compliance by external service providers of system services acquisition documentation contracts service level agreements interagency agreements licensing agreements list of organizational security and privacy requirements for external provider services control assessment results or reports from external providers of system services system security plan privacy plan supply chain risk management plan other relevant documents or records

Interview

Organizational personnel with acquisition responsibilities external providers of system services organizational personnel with information security and privacy responsibilities organizational personnel with supply chain risk management responsibilities
SA-11 [P] Developer Testing and Evaluation

Control

Require the developer of the system, system component, or system service, at all post-design stages of the system development life cycle, to:
  1. Develop and implement a plan for ongoing security and privacy control assessments;
  2. Perform [Selection(one-or-more): unit; integration; system; regression] testing/evaluation [Assignement: frequency to conduct] at [Assignement: depth and coverage];
  3. Produce evidence of the execution of the assessment plan and the results of the testing and evaluation;
  4. Implement a verifiable flaw remediation process; and
  5. Correct flaws identified during testing and evaluation.

Discussion

Developmental testing and evaluation confirms that the required controls are implemented correctly, operating as intended, enforcing the desired security and privacy policies, and meeting established security and privacy requirements. Security properties of systems and the privacy of individuals may be affected by the interconnection of system components or changes to those components. The interconnections or changes—including upgrading or replacing applications, operating systems, and firmware—may adversely affect previously implemented controls. Ongoing assessment during development allows for additional types of testing and evaluation that developers can conduct to reduce or eliminate potential flaws. Testing custom software applications may require approaches such as manual code review, security architecture review, and penetration testing, as well as and static analysis, dynamic analysis, binary analysis, or a hybrid of the three analysis approaches. Developers can use the analysis approaches, along with security instrumentation and fuzzing, in a variety of tools and in source code reviews. The security and privacy assessment plans include the specific activities that developers plan to carry out, including the types of analyses, testing, evaluation, and reviews of software and firmware components; the degree of rigor to be applied; the frequency of the ongoing testing and evaluation; and the types of artifacts produced during those processes. The depth of testing and evaluation refers to the rigor and level of detail associated with the assessment process. The coverage of testing and evaluation refers to the scope (i.e., number and type) of the artifacts included in the assessment process. Contracts specify the acceptance criteria for security and privacy assessment plans, flaw remediation processes, and the evidence that the plans and processes have been diligently applied. Methods for reviewing and protecting assessment plans, evidence, and documentation are commensurate with the security category or classification level of the system. Contracts may specify protection requirements for documentation.

Assessment Objective

    1. the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop a plan for ongoing security assessments;
    2. the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing security assessments;
    3. the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop a plan for privacy assessments;
    4. the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing privacy assessments;
  2. the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to perform [Selection(one-or-more): unit; integration; system; regression] testing/evaluation [Assignement: frequency to conduct] at [Assignement: depth and coverage];
    1. the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to produce evidence of the execution of the assessment plan;
    2. the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to produce the results of the testing and evaluation;
  4. the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a verifiable flaw remediation process;
  5. the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to correct flaws identified during testing and evaluation.

Assessment Method

Examine

System and services acquisition policy system and services acquisition procedures procedures addressing system developer security and privacy testing procedures addressing flaw remediation solicitation documentation acquisition documentation service level agreements acquisition contracts for the system, system component, or system service security and privacy architecture system design documentation system developer security and privacy assessment plans results of developer security and privacy assessments for the system, system component, or system service security and privacy flaw and remediation tracking records system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with developer security and privacy testing responsibilities system developers

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace