+SA-04 Acquisition Process
---+SA-04(01) Functional Properties of Controls
---+SA-04(02) Design and Implementation Information for Controls
---+SA-04(03) Development Methods, Techniques, and Practices
---+SA-04(05) System, Component, and Service Configurations
---+SA-04(06) Use of Information Assurance Products
---+SA-04(07) NIAP-approved Protection Profiles
---+SA-04(08) Continuous Monitoring Plan for Controls
---+SA-04(09) Functions, Ports, Protocols, and Services in Use
---+SA-04(10) Use of Approved PIV Products
---+SA-04(11) System of Records
---+SA-04(12) Data Ownership
|
SA-04 Acquisition Process
Control
Include the following requirements, descriptions, and criteria, explicitly or by reference, using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service:- Security and privacy functional requirements;
- Strength of mechanism requirements;
- Security and privacy assurance requirements;
- Controls needed to satisfy the security and privacy requirements.
- Security and privacy documentation requirements;
- Requirements for protecting security and privacy documentation;
- Description of the system development environment and environment in which the system is intended to operate;
- Allocation of responsibility or identification of parties responsible for information security, privacy, and supply chain risk management; and
- Acceptance criteria.
Discussion
Security and privacy functional requirements are typically derived from the high-level security and privacy requirements described in [SA-2](#sa-2) . The derived requirements include security and privacy capabilities, functions, and mechanisms. Strength requirements associated with such capabilities, functions, and mechanisms include degree of correctness, completeness, resistance to tampering or bypass, and resistance to direct attack. Assurance requirements include development processes, procedures, and methodologies as well as the evidence from development and assessment activities that provide grounds for confidence that the required functionality is implemented and possesses the required strength of mechanism. [SP 800-160-1](#e3cc0520-a366-4fc9-abc2-5272db7e3564) describes the process of requirements engineering as part of the system development life cycle.
Controls can be viewed as descriptions of the safeguards and protection capabilities appropriate for achieving the particular security and privacy objectives of the organization and for reflecting the security and privacy requirements of stakeholders. Controls are selected and implemented in order to satisfy system requirements and include developer and organizational responsibilities. Controls can include technical, administrative, and physical aspects. In some cases, the selection and implementation of a control may necessitate additional specification by the organization in the form of derived requirements or instantiated control parameter values. The derived requirements and control parameter values may be necessary to provide the appropriate level of implementation detail for controls within the system development life cycle.
Security and privacy documentation requirements address all stages of the system development life cycle. Documentation provides user and administrator guidance for the implementation and operation of controls. The level of detail required in such documentation is based on the security categorization or classification level of the system and the degree to which organizations depend on the capabilities, functions, or mechanisms to meet risk response expectations. Requirements can include mandated configuration settings that specify allowed functions, ports, protocols, and services. Acceptance criteria for systems, system components, and system services are defined in the same manner as the criteria for any organizational acquisition or procurement.
Organizations can determine other requirements that support security and operations, to include responsibilities for the organization and developer, and notification and timing requirements for support, maintenance and updates.
Assessment Objective
- security functional requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
- privacy functional requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
- strength of mechanism requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
- security assurance requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
- privacy assurance requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
- controls needed to satisfy the security requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
- controls needed to satisfy the privacy requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
- security documentation requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
- privacy documentation requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
- requirements for protecting security documentation, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
- requirements for protecting privacy documentation, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
- the description of the system development environment and environment in which the system is intended to operate, requirements, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
- the allocation of responsibility or identification of parties responsible for information security requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service;
- the allocation of responsibility or identification of parties responsible for privacy requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ];
- the allocation of responsibility or identification of parties responsible for supply chain risk management requirements, descriptions, and criteria are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ];
- acceptance criteria requirements and descriptions are included explicitly or by reference using [Selection(one-or-more): standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service.
Assessment Method
Examine
System and services acquisition policy
system and services acquisition procedures
procedures addressing the integration of information security and privacy and supply chain risk management into the acquisition process
configuration management plan
acquisition contracts for the system, system component, or system service
system design documentation
system security plan
supply chain risk management plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with acquisition/contracting responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
organizational personnel with supply chain risk management responsibilities
1. Übersicht
| Bezeichnung |
Standard |
|
SA-04(01) Functional Properties of Controls
|
Control
Require the developer of the system, system component, or system service to provide a description of the functional properties of the controls to be implemented.
Discussion
Functional properties of security and privacy controls describe the functionality (i.e., security or privacy capability, functions, or mechanisms) visible at the interfaces of the controls and specifically exclude functionality and data structures internal to the operation of the controls.
Assessment Objective
the developer of the system, system component, or system service is required to provide a description of the functional properties of the controls to be implemented.
Assessment Method
Examine
System and services acquisition policy
system and services acquisition procedures
procedures addressing the integration of security and privacy requirements, descriptions, and criteria into the acquisition process
solicitation documents
acquisition documentation
acquisition contracts for the system, system component, or system services
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with acquisition/contracting responsibilities
organizational personnel with information security and privacy responsibilities
system developers
|
|
SA-04(02) Design and Implementation Information for Controls
|
Control
Require the developer of the system, system component, or system service to provide design and implementation information for the controls that includes: [Selection(one-or-more): security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; {{ insert: param, sa-04.02_odp.02 }} ] at [Assignement: level of detail].
Discussion
Organizations may require different levels of detail in the documentation for the design and implementation of controls in organizational systems, system components, or system services based on mission and business requirements, requirements for resiliency and trustworthiness, and requirements for analysis and testing. Systems can be partitioned into multiple subsystems. Each subsystem within the system can contain one or more modules. The high-level design for the system is expressed in terms of subsystems and the interfaces between subsystems providing security-relevant functionality. The low-level design for the system is expressed in terms of modules and the interfaces between modules providing security-relevant functionality. Design and implementation documentation can include manufacturer, version, serial number, verification hash signature, software libraries used, date of purchase or download, and the vendor or download source. Source code and hardware schematics are referred to as the implementation representation of the system.
Assessment Objective
the developer of the system, system component, or system service is required to provide design and implementation information for the controls that includes using [Selection(one-or-more): security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; {{ insert: param, sa-04.02_odp.02 }} ] at [Assignement: level of detail].
Assessment Method
Examine
System and services acquisition policy
system and services acquisition procedures
procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process
solicitation documents
acquisition documentation
acquisition contracts for the system, system components, or system services
design and implementation information for controls employed in the system, system component, or system service
system security plan
other relevant documents or records
Interview
Organizational personnel with acquisition/contracting responsibilities
organizational personnel with the responsibility to determine system security requirements
system developers or service provider
organizational personnel with information security responsibilities
|
|
SA-04(03) Development Methods, Techniques, and Practices
|
Control
Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes:- [Assignement: systems engineering methods];
- [Selection(one-or-more): {{ insert: param, sa-04.03_odp.03 }} ; {{ insert: param, sa-04.03_odp.04 }} ] ; and
- [Selection(one-or-more): {{ insert: param, sa-04.03_odp.06 }} ; {{ insert: param, sa-04.03_odp.07 }} ; {{ insert: param, sa-04.03_odp.08 }} ].
Discussion
Following a system development life cycle that includes state-of-the-practice software development methods, systems engineering methods, systems security and privacy engineering methods, and quality control processes helps to reduce the number and severity of latent errors within systems, system components, and system services. Reducing the number and severity of such errors reduces the number of vulnerabilities in those systems, components, and services. Transparency in the methods and techniques that developers select and implement for systems engineering, systems security and privacy engineering, software development, component and system assessments, and quality control processes provides an increased level of assurance in the trustworthiness of the system, system component, or system service being acquired.
Assessment Objective
- the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes [Assignement: systems engineering methods];
- the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes [Selection(one-or-more): {{ insert: param, sa-04.03_odp.03 }} ; {{ insert: param, sa-04.03_odp.04 }} ];
- the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes [Selection(one-or-more): {{ insert: param, sa-04.03_odp.06 }} ; {{ insert: param, sa-04.03_odp.07 }} ; {{ insert: param, sa-04.03_odp.08 }} ].
Assessment Method
Examine
System and services acquisition policy
system and services acquisition procedures
procedures addressing the integration of security and privacy requirements, descriptions, and criteria into the acquisition process
solicitation documents
acquisition documentation
acquisition contracts for the system, system component, or system service
list of systems security and privacy engineering methods to be included in the developer’s system development life cycle process
list of software development methods to be included in the developer’s system development life cycle process
list of testing, evaluation, or validation techniques to be included in the developer’s system development life cycle process
list of quality control processes to be included in the developer’s system development life cycle process
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with acquisition/contracting responsibilities
organizational personnel with information security and privacy responsibilities
organizational personnel with system life cycle responsibilities
system developers or service provider
|
|
SA-04(05) System, Component, and Service Configurations
|
Control
Require the developer of the system, system component, or system service to:- Deliver the system, component, or service with [Assignement: security configurations] implemented; and
- Use the configurations as the default for any subsequent system, component, or service reinstallation or upgrade.
Discussion
Examples of security configurations include the U.S. Government Configuration Baseline (USGCB), Security Technical Implementation Guides (STIGs), and any limitations on functions, ports, protocols, and services. Security characteristics can include requiring that default passwords have been changed.
Assessment Objective
- the developer of the system, system component, or system service is required to deliver the system, component, or service with [Assignement: security configurations] implemented;
- the configurations are used as the default for any subsequent system, component, or service reinstallation or upgrade.
Assessment Method
Examine
System and services acquisition policy
procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process
solicitation documents
acquisition documentation
acquisition contracts for the system, system component, or system service
security configurations to be implemented by the developer of the system, system component, or system service
service level agreements
system security plan
other relevant documents or records
Interview
Organizational personnel with acquisition/contracting responsibilities
organizational personnel with the responsibility to determine system security requirements
system developers or service provider
organizational personnel with information security responsibilities
|
|
SA-04(06) Use of Information Assurance Products
|
Control
- Employ only government off-the-shelf or commercial off-the-shelf information assurance and information assurance-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted; and
- Ensure that these products have been evaluated and/or validated by NSA or in accordance with NSA-approved procedures.
Discussion
Commercial off-the-shelf IA or IA-enabled information technology products used to protect classified information by cryptographic means may be required to use NSA-approved key management. See [NSA CSFC](#3d575737-98cb-459d-b41c-d7e82b73ad78).
Assessment Objective
- only government off-the-shelf or commercial off-the-shelf information assurance and information assurance-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted are employed;
- these products have been evaluated and/or validated by NSA or in accordance with NSA-approved procedures.
Assessment Method
Examine
Supply chain risk management plan
system and services acquisition policy
procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process
solicitation documents
acquisition documentation
acquisition contracts for the system, system component, or system service
security configurations to be implemented by the developer of the system, system component, or system service
service level agreements
list of deployed IT products/solutions
NSA-approved list
system security plan
other relevant documents or records
Interview
Organizational personnel with acquisition/contracting responsibilities
organizational personnel with the responsibility to determine system security requirements
organizational personnel responsible for ensuring information assurance products are NSA-approved and are evaluated and/or validated products in accordance with NSA-approved procedures
organizational personnel with information security responsibilities
|
|
SA-04(07) NIAP-approved Protection Profiles
|
Control
- Limit the use of commercially provided information assurance and information assurance-enabled information technology products to those products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists; and
- Require, if no NIAP-approved Protection Profile exists for a specific technology type but a commercially provided information technology product relies on cryptographic functionality to enforce its security policy, that the cryptographic module is FIPS-validated or NSA-approved.
Discussion
See [NIAP CCEVS](#795aff72-3e6c-4b6b-a80a-b14d84b7f544) for additional information on NIAP. See [NIST CMVP](#1acdc775-aafb-4d11-9341-dc6a822e9d38) for additional information on FIPS-validated cryptographic modules.
Assessment Objective
- the use of commercially provided information assurance and information assurance-enabled information technology products is limited to those products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists;
- if no NIAP-approved Protection Profile exists for a specific technology type but a commercially provided information technology product relies on cryptographic functionality to enforce its security policy, that cryptographic module is required to be FIPS-validated or NSA-approved.
Assessment Method
Examine
Supply chain risk management plan
system and services acquisition policy
procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process
solicitation documents
acquisition documentation
acquisition contracts for the system, system component, or system service
list of deployed IT products/solutions
NAIP-approved protection profiles
FIPS-validation information for cryptographic functionality
system security plan
other relevant documents or records
Interview
Organizational personnel with acquisition/contracting responsibilities
organizational personnel with the responsibility for determining system security requirements
organizational personnel responsible for ensuring that information assurance products have been evaluated against a NIAP-approved protection profile or for ensuring products relying on cryptographic functionality are FIPS-validated
organizational personnel with information security responsibilities
|
|
SA-04(08) Continuous Monitoring Plan for Controls
|
Control
Require the developer of the system, system component, or system service to produce a plan for continuous monitoring of control effectiveness that is consistent with the continuous monitoring program of the organization.
Discussion
The objective of continuous monitoring plans is to determine if the planned, required, and deployed controls within the system, system component, or system service continue to be effective over time based on the inevitable changes that occur. Developer continuous monitoring plans include a sufficient level of detail such that the information can be incorporated into continuous monitoring programs implemented by organizations. Continuous monitoring plans can include the types of control assessment and monitoring activities planned, frequency of control monitoring, and actions to be taken when controls fail or become ineffective.
Assessment Objective
the developer of the system, system component, or system service is required to produce a plan for the continuous monitoring of control effectiveness that is consistent with the continuous monitoring program of the organization.
Assessment Method
Examine
System and services acquisition policy
procedures addressing developer continuous monitoring plans
procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process
developer continuous monitoring plans
security assessment plans
acquisition contracts for the system, system component, or system service
acquisition documentation
solicitation documentation
service level agreements
system security plan
other relevant documents or records
Interview
Organizational personnel with acquisition/contracting responsibilities
organizational personnel with the responsibility for determining system security requirements
system developers
organizational personnel with information security responsibilities
|
|
SA-04(09) Functions, Ports, Protocols, and Services in Use
|
Control
Require the developer of the system, system component, or system service to identify the functions, ports, protocols, and services intended for organizational use.
Discussion
The identification of functions, ports, protocols, and services early in the system development life cycle (e.g., during the initial requirements definition and design stages) allows organizations to influence the design of the system, system component, or system service. This early involvement in the system development life cycle helps organizations avoid or minimize the use of functions, ports, protocols, or services that pose unnecessarily high risks and understand the trade-offs involved in blocking specific ports, protocols, or services or requiring system service providers to do so. Early identification of functions, ports, protocols, and services avoids costly retrofitting of controls after the system, component, or system service has been implemented. [SA-9](#sa-9) describes the requirements for external system services. Organizations identify which functions, ports, protocols, and services are provided from external sources.
Assessment Objective
- the developer of the system, system component, or system service is required to identify the functions intended for organizational use;
- the developer of the system, system component, or system service is required to identify the ports intended for organizational use;
- the developer of the system, system component, or system service is required to identify the protocols intended for organizational use;
- the developer of the system, system component, or system service is required to identify the services intended for organizational use.
Assessment Method
Examine
System and services acquisition policy
procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process
system design documentation
system documentation, including functions, ports, protocols, and services intended for organizational use
acquisition contracts for systems or services
acquisition documentation
solicitation documentation
service level agreements
organizational security requirements, descriptions, and criteria for developers of systems, system components, and system services
system security plan
other relevant documents or records
Interview
Organizational personnel with acquisition/contracting responsibilities
organizational personnel with the responsibility for determining system security requirements
system/network administrators
organizational personnel operating, using, and/or maintaining the system
system developers
organizational personnel with information security responsibilities
|
|
SA-04(10) Use of Approved PIV Products
|
Control
Employ only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational systems.
Discussion
Products on the FIPS 201-approved products list meet NIST requirements for Personal Identity Verification (PIV) of Federal Employees and Contractors. PIV cards are used for multi-factor authentication in systems and organizations.
Assessment Objective
only information technology products on the FIPS 201-approved products list for the Personal Identity Verification (PIV) capability implemented within organizational systems are employed.
Assessment Method
Examine
Supply chain risk management plan
system and services acquisition policy
procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process
solicitation documentation
acquisition documentation
acquisition contracts for the system, system component, or system service
service level agreements
FIPS 201 approved products list
system security plan
other relevant documents or records
Interview
Organizational personnel with acquisition/contracting responsibilities
organizational personnel with the responsibility for determining system security requirements
organizational personnel with the responsibility for ensuring that only FIPS 201- approved products are implemented
organizational personnel with information security responsibilities
|
|
SA-04(11) System of Records
|
Control
Include [Assignement: Privacy Act requirements] in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mission or function.
Discussion
When, by contract, an organization provides for the operation of a system of records to accomplish an organizational mission or function, the organization, consistent with its authority, causes the requirements of the [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) to be applied to the system of records.
Assessment Objective
[Assignement: Privacy Act requirements] are defined in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mission or function.
Assessment Method
Examine
System and services acquisition policy
system and services acquisition procedures
procedures addressing the integration of Privacy Act requirements into systems of records operated by external organizations
solicitation documentation
acquisition documentation
acquisition contracts for the system, system component, or system service
service level agreements
system security plan
privacy plan
personally identifiable information processing policy
privacy program plan
privacy impact assessment
privacy risk assessment documentation
other relevant documents or records
Interview
Organizational personnel with acquisition responsibilities
organizational personnel with information security and privacy responsibilities
|
|
SA-04(12) Data Ownership
|
Control
- Include organizational data ownership requirements in the acquisition contract; and
- Require all data to be removed from the contractor’s system and returned to the organization within [Assignement: time frame].
Discussion
Contractors who operate a system that contains data owned by an organization initiating the contract have policies and procedures in place to remove the data from their systems and/or return the data in a time frame defined by the contract.
Assessment Objective
- organizational data ownership requirements are included in the acquisition contract;
- all data to be removed from the contractor’s system and returned to the organization is required within [Assignement: time frame].
Assessment Method
Examine
System and services acquisition policy
system and services acquisition procedures
procedures addressing the integration of information security and privacy requirements, descriptions, and criteria into the acquisition process
procedures addressing the disposition of personally identifiable information
solicitation documentation
acquisition documentation
acquisition contracts for the system or system service
personally identifiable information processing policy
service level agreements
information sharing agreements
memoranda of understanding
system security plan
privacy plan
privacy impact assessment
privacy risk assessment documentation
other relevant documents or records
Interview
Organizational personnel with acquisition/contracting responsibilities
organizational personnel with the responsibility for data management and processing requirements
organizational personnel with information security and privacy responsibilities
|
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
Verknüpfte Vorgänge
|