+SA-09 External System Services
---+SA-09(01) Risk Assessments and Organizational Approvals
---+SA-09(02) Identification of Functions, Ports, Protocols, and Services
---+SA-09(03) Establish and Maintain Trust Relationship with Providers
---+SA-09(04) Consistent Interests of Consumers and Providers
---+SA-09(05) Processing, Storage, and Service Location
---+SA-09(06) Organization-controlled Cryptographic Keys
---+SA-09(07) Organization-controlled Integrity Checking
---+SA-09(08) Processing and Storage Location — U.S. Jurisdiction

SA-09 External System Services

Control

  1. Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: [Assignement: controls];
  2. Define and document organizational oversight and user roles and responsibilities with regard to external system services; and
  3. Employ the following processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis: [Assignement: processes, methods, and techniques].

Discussion

External system services are provided by an external provider, and the organization has no direct control over the implementation of the required controls or the assessment of control effectiveness. Organizations establish relationships with external service providers in a variety of ways, including through business partnerships, contracts, interagency agreements, lines of business arrangements, licensing agreements, joint ventures, and supply chain exchanges. The responsibility for managing risks from the use of external system services remains with authorizing officials. For services external to organizations, a chain of trust requires that organizations establish and retain a certain level of confidence that each provider in the consumer-provider relationship provides adequate protection for the services rendered. The extent and nature of this chain of trust vary based on relationships between organizations and the external providers. Organizations document the basis for the trust relationships so that the relationships can be monitored. External system services documentation includes government, service providers, end user security roles and responsibilities, and service-level agreements. Service-level agreements define the expectations of performance for implemented controls, describe measurable outcomes, and identify remedies and response requirements for identified instances of noncompliance.

Assessment Objective

    1. providers of external system services comply with organizational security requirements;
    2. providers of external system services comply with organizational privacy requirements;
    3. providers of external system services employ [Assignement: controls];
    1. organizational oversight with regard to external system services are defined and documented;
    2. user roles and responsibilities with regard to external system services are defined and documented;
  3. [Assignement: processes, methods, and techniques] are employed to monitor control compliance by external service providers on an ongoing basis.

Assessment Method

Examine

System and services acquisition policy system and services acquisition procedures procedures addressing methods and techniques for monitoring control compliance by external service providers of system services acquisition documentation contracts service level agreements interagency agreements licensing agreements list of organizational security and privacy requirements for external provider services control assessment results or reports from external providers of system services system security plan privacy plan supply chain risk management plan other relevant documents or records

Interview

Organizational personnel with acquisition responsibilities external providers of system services organizational personnel with information security and privacy responsibilities organizational personnel with supply chain risk management responsibilities

1. Übersicht

SA-09(01) Risk Assessments and Organizational Approvals

Control

  1. Conduct an organizational assessment of risk prior to the acquisition or outsourcing of information security services; and
  2. Verify that the acquisition or outsourcing of dedicated information security services is approved by [Assignement: personnel or roles].

Discussion

Information security services include the operation of security devices, such as firewalls or key management services as well as incident monitoring, analysis, and response. Risks assessed can include system, mission or business, security, privacy, or supply chain risks.

Assessment Objective

  1. an organizational assessment of risk is conducted prior to the acquisition or outsourcing of information security services;
  2. [Assignement: personnel or roles] approve the acquisition or outsourcing of dedicated information security services.

Assessment Method

Examine

System and services acquisition policy supply chain risk management policy and procedures procedures addressing external system services acquisition documentation acquisition contracts for the system, system component, or system service risk assessment reports approval records for the acquisition or outsourcing of dedicated security services system security plan supply chain risk management plan other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with system security responsibilities external providers of system services organizational personnel with information security responsibilities organizational personnel with supply chain risk management responsibilities
SA-09(02) Identification of Functions, Ports, Protocols, and Services

Control

Require providers of the following external system services to identify the functions, ports, protocols, and other services required for the use of such services: [Assignement: external system services].

Discussion

Information from external service providers regarding the specific functions, ports, protocols, and services used in the provision of such services can be useful when the need arises to understand the trade-offs involved in restricting certain functions and services or blocking certain ports and protocols.

Assessment Objective

providers of [Assignement: external system services] are required to identify the functions, ports, protocols, and other services required for the use of such services.

Assessment Method

Examine

System and services acquisition policy supply chain risk management policy and procedures procedures addressing external system services acquisition contracts for the system, system component, or system service acquisition documentation solicitation documentation service level agreements organizational security requirements and security specifications for external service providers list of required functions, ports, protocols, and other services system security plan other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities system/network administrators external providers of system services
SA-09(03) Establish and Maintain Trust Relationship with Providers

Control

Establish, document, and maintain trust relationships with external service providers based on the following requirements, properties, factors, or conditions: [Assignement: organization-defined security and privacy requirements, properties, factors, or conditions defining acceptable trust relationships].

Discussion

Trust relationships between organizations and external service providers reflect the degree of confidence that the risk from using external services is at an acceptable level. Trust relationships can help organizations gain increased levels of confidence that service providers are providing adequate protection for the services rendered and can also be useful when conducting incident response or when planning for upgrades or obsolescence. Trust relationships can be complicated due to the potentially large number of entities participating in the consumer-provider interactions, subordinate relationships and levels of trust, and types of interactions between the parties. In some cases, the degree of trust is based on the level of control that organizations can exert on external service providers regarding the controls necessary for the protection of the service, information, or individual privacy and the evidence brought forth as to the effectiveness of the implemented controls. The level of control is established by the terms and conditions of the contracts or service-level agreements.

Assessment Objective

  1. trust relationships with external service provides based on [Assignement: security requirements, properties, factors, or conditions] are established and documented;
  2. trust relationships with external service provides based on [Assignement: security requirements, properties, factors, or conditions] are maintained;
  3. trust relationships with external service provides based on [Assignement: privacy requirements, properties, factors, or conditions] are established and documented;
  4. trust relationships with external service provides based on [Assignement: privacy requirements, properties, factors, or conditions] are maintained.

Assessment Method

Examine

System and services acquisition policy system and services acquisition procedures acquisition contracts for the system, system component, or system service acquisition documentation solicitation documentation service level agreements memorandum of understanding memorandum of agreements list of organizational security and privacy requirements, properties, factors, or conditions for external provider services documentation of trust relationships with external service providers system security plan privacy plan supply chain risk management plan other relevant documents or records

Interview

Organizational personnel with acquisition responsibilities organizational personnel with information security and privacy responsibilities external providers of system services organizational personnel with supply chain risk management responsibilities
SA-09(04) Consistent Interests of Consumers and Providers

Control

Take the following actions to verify that the interests of [Assignement: external service providers] are consistent with and reflect organizational interests: [Assignement: actions].

Discussion

As organizations increasingly use external service providers, it is possible that the interests of the service providers may diverge from organizational interests. In such situations, simply having the required technical, management, or operational controls in place may not be sufficient if the providers that implement and manage those controls are not operating in a manner consistent with the interests of the consuming organizations. Actions that organizations take to address such concerns include requiring background checks for selected service provider personnel; examining ownership records; employing only trustworthy service providers, such as providers with which organizations have had successful trust relationships; and conducting routine, periodic, unscheduled visits to service provider facilities.

Assessment Objective

[Assignement: actions] are taken to verify that the interests of [Assignement: external service providers] are consistent with and reflect organizational interests.

Assessment Method

Examine

System and services acquisition policy procedures addressing external system services acquisition contracts for the system, system component, or system service solicitation documentation acquisition documentation service level agreements organizational security requirements/safeguards for external service providers personnel security policies for external service providers assessments performed on external service providers system security plan supply chain risk management plan other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities external providers of system services organizational personnel with supply chain risk management responsibilities
SA-09(05) Processing, Storage, and Service Location

Control

Restrict the location of [Selection(one-or-more): information processing; information or data; system services] to [Assignement: locations] based on [Assignement: requirements].

Discussion

The location of information processing, information and data storage, or system services can have a direct impact on the ability of organizations to successfully execute their mission and business functions. The impact occurs when external providers control the location of processing, storage, or services. The criteria that external providers use for the selection of processing, storage, or service locations may be different from the criteria that organizations use. For example, organizations may desire that data or information storage locations be restricted to certain locations to help facilitate incident response activities in case of information security incidents or breaches. Incident response activities, including forensic analyses and after-the-fact investigations, may be adversely affected by the governing laws, policies, or protocols in the locations where processing and storage occur and/or the locations from which system services emanate.

Assessment Objective

based on [Assignement: requirements], [Selection(one-or-more): information processing; information or data; system services] is/are restricted to [Assignement: locations].

Assessment Method

Examine

System and services acquisition policy procedures addressing external system services acquisition contracts for the system, system component, or system service solicitation documentation acquisition documentation service level agreements restricted locations for information processing information/data and/or system services information processing, information/data, and/or system services to be maintained in restricted locations organizational security requirements or conditions for external providers system security plan supply chain risk management plan other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities external providers of system services organizational personnel with supply chain risk management responsibilities
SA-09(06) Organization-controlled Cryptographic Keys

Control

Maintain exclusive control of cryptographic keys for encrypted material stored or transmitted through an external system.

Discussion

Maintaining exclusive control of cryptographic keys in an external system prevents decryption of organizational data by external system staff. Organizational control of cryptographic keys can be implemented by encrypting and decrypting data inside the organization as data is sent to and received from the external system or by employing a component that permits encryption and decryption functions to be local to the external system but allows exclusive organizational access to the encryption keys.

Assessment Objective

exclusive control of cryptographic keys is maintained for encrypted material stored or transmitted through an external system.

Assessment Method

Examine

System and services acquisition policy procedures addressing external system services acquisition contracts for the system, system component, or system service solicitation documentation acquisition documentation service level agreements procedures addressing organization-controlled cryptographic key management organizational security requirements or conditions for external providers system security plan supply chain risk management plan other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities organization personnel with cryptographic key management responsibilities external providers of system services organizational personnel with supply chain risk management responsibilities
SA-09(07) Organization-controlled Integrity Checking

Control

Provide the capability to check the integrity of information while it resides in the external system.

Discussion

Storage of organizational information in an external system could limit visibility into the security status of its data. The ability of the organization to verify and validate the integrity of its stored data without transferring it out of the external system provides such visibility.

Assessment Objective

the capability is provided to check the integrity of information while it resides in the external system.

Assessment Method

Examine

System and services acquisition policy procedures addressing external system services acquisition contracts for the system, system component, or system service solicitation documentation acquisition documentation service level agreements procedures addressing organization-controlled integrity checking information/data and/or system services organizational security requirements or conditions for external providers system security plan supply chain risk management plan other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities organization personnel with integrity checking responsibilities external providers of system services organizational personnel with supply chain risk management responsibilities
SA-09(08) Processing and Storage Location — U.S. Jurisdiction

Control

Restrict the geographic location of information processing and data storage to facilities located within in the legal jurisdictional boundary of the United States.

Discussion

The geographic location of information processing and data storage can have a direct impact on the ability of organizations to successfully execute their mission and business functions. A compromise or breach of high impact information and systems can have severe or catastrophic adverse impacts on organizational assets and operations, individuals, other organizations, and the Nation. Restricting the processing and storage of high-impact information to facilities within the legal jurisdictional boundary of the United States provides greater control over such processing and storage.

Assessment Objective

the geographic location of information processing and data storage is restricted to facilities located within the legal jurisdictional boundary of the United States.

Assessment Method

Examine

System and services acquisition policy system and services acquisition procedures procedures addressing external system services acquisition contracts for the system, system component, or system service solicitation documentation acquisition documentation service level agreements procedures addressing determining jurisdiction restrictions for processing and storage location information/data and/or system services organizational security requirements or conditions for external providers system security plan supply chain risk management plan other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities organization personnel with supply chain risk management responsibilities external providers of system services

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
is blocked by SA-09 External System Services – Assessment Procedure
is blocked by Third-Party Services