03.16 System and Services Acquisition

Statement

Apply the following systems security engineering principles to the development or modification of the system and system components: {{ insert: param, A.03.16.01.ODP.01 }}.

Guidance

Organizations apply systems security engineering principles to new development systems. For legacy systems, organizations apply systems security engineering principles to system modifications to the extent feasible, given the current state of hardware, software, and firmware components. The application of systems security engineering principles helps to develop trustworthy, secure, and resilient systems and reduce the susceptibility of organizations to disruptions, hazards, and threats. Examples include developing layered protections; establishing security policies, architectures, and controls as the foundation for system design; incorporating security requirements into the system development life cycle; delineating physical and logical security boundaries; ensuring that developers are trained on how to build trustworthy secure software; and performing threat modeling to identify use cases, threat agents, attack vectors and patterns, design patterns, and compensating controls needed to mitigate risk. Organizations that apply security engineering principles can facilitate the development of trustworthy, secure systems, system components, and system services; reduce risks to acceptable levels; and make informed risk-management decisions.

Assessment objective

{{ insert: param, A.03.16.01.ODP.01 }} are applied to the development or modification of the system and system components.

Assessment method

• system and services acquisition policy system and services acquisition procedures procedures addressing security engineering principles used in the development and modification of the system system design documentation security requirements and specifications for the system system security plan other relevant documents or records

Assessment method

• personnel with acquisition/contracting responsibilities personnel with information security responsibilities personnel with system development and modification responsibilities system developers

Assessment method

• processes for applying security engineering principles in system development and modification mechanisms supporting the application of security engineering principles in system development and modification

Statement

• a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer.

• b. Provide options for risk mitigation or alternative sources for continued support for unsupported components that cannot be replaced.

Guidance

Support for system components includes software patches, firmware updates, replacement parts, and maintenance contracts. An example of unsupported components includes when vendors no longer provide critical software patches or product updates, which can result in opportunities for adversaries to exploit weaknesses or deficiencies in the installed components. Exceptions to replacing unsupported system components include systems that provide critical mission or business capabilities when newer technologies are unavailable or when the systems are so isolated that installing replacement components is not an option. Alternative sources of support address the need to provide continued support for system components that are no longer supported by the original manufacturers, developers, or vendors when such components remain essential to organizational missions and business functions. If necessary, organizations can establish in-house support by developing customized patches for critical software components or obtain the services of external service providers who provide ongoing support for unsupported components through contractual relationships. Such contractual relationships can include open-source software value-added vendors. The increased risk of using unsupported system components can be mitigated by prohibiting the connection of such components to public or uncontrolled networks or implementing other forms of isolation.

Assessment objective

options for risk mitigation or alternative sources for continued support for unsupported components that cannot be replaced are provided.

Assessment objective

system components are replaced when support for the components is no longer available from the developer, vendor, or manufacturer.

Assessment method

• system and services acquisition policy and procedures procedures for the replacement or continued use of unsupported system components documented evidence of replacing unsupported system components documented approvals (including justification) for the continued use of unsupported system components SCRM plan system security plan other relevant documents or records

Assessment method

• personnel with system and service acquisition responsibilities personnel responsible for component replacement personnel with system development life cycle responsibilities personnel with information security responsibilities

Assessment method

• processes for replacing unsupported system components mechanisms for supporting or implementing the replacement of unsupported system components

Statement

• a. Require the providers of external system services used for the processing, storage, or transmission of CUI to comply with the following security requirements: {{ insert: param, A.03.16.03.ODP.01 }}.

• b. Define and document user roles and responsibilities with regard to external system services, including shared responsibilities with external service providers.

• c. Implement processes, methods, and techniques to monitor security requirement compliance by external service providers on an ongoing basis.

Guidance

External system services are provided by external service providers. Organizations establish relationships with external service providers in a variety of ways, including through business partnerships, contracts, interagency agreements, lines of business arrangements, licensing agreements, joint ventures, and supply chain exchanges. The responsibility for managing risks from the use of external system services remains with the organization charged with protecting CUI. Service-level agreements define expectations of performance, describe measurable outcomes, and identify remedies, mitigations, and response requirements for instances of noncompliance. Information from external service providers regarding the specific functions, ports, protocols, and services used in the provision of such services can be useful when there is a need to understand the trade-offs involved in restricting certain functions and services or blocking certain ports and protocols. This requirement is related to [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.01.20) 03.01.20.

Assessment objective

the providers of external system services used for the processing, storage, or transmission of CUI comply with the following security requirements: {{ insert: param, A.03.16.03.ODP.01 }}.

Assessment objective

processes, methods, and techniques to monitor security requirement compliance by external service providers on an ongoing basis are implemented.

Assessment objective

user roles and responsibilities with regard to external system services, including shared responsibilities with external service providers, are defined and documented.

Assessment method

• system and services acquisition policy and procedures procedures for monitoring security requirement compliance by external service providers acquisition documentation contracts service-level agreements interagency agreements licensing agreements list of security requirements for external provider services assessment results or reports from external service providers SCRM plan system security plan other relevant documents or records

Assessment method

• personnel with acquisition responsibilities external providers of system services personnel with SCRM responsibilities personnel with information security responsibilities

Assessment method

• organizational processes for monitoring security and privacy control compliance by external service providers on an ongoing basis mechanisms for monitoring security and privacy control compliance by external service providers on an ongoing basis