Assessment Objective
Determine if:
- SA-09(02) providers of [Assignment: external system services] are required to identify the functions, ports, protocols, and other services required for the use of such services.
Assessment Methods
Examine
- System and services acquisition policy
- supply chain risk management policy and procedures
- procedures addressing external system services
- acquisition contracts for the system, system component, or system service
- acquisition documentation
- solicitation documentation
- service level agreements
- organizational security requirements and security specifications for external service providers
- list of required functions, ports, protocols, and other services
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system and service acquisition responsibilities
- organizational personnel with information security responsibilities
- system/network administrators
- external providers of system services
Συνδεδεμένα ζητήματα
| Τύπος σύνδεσης | Ζήτημα |
|---|---|
| blocks | SA-09(02) [H] Identification of Functions, Ports, Protocols, and Services |