3.16 System and Services Acquisition

Statement

Employ {{ insert: param, A.03.16.01E.ODP.01 }} on {{ insert: param, A.03.16.01E.ODP.02 }} supporting mission-essential services or functions to increase the trustworthiness in those systems or components.

Guidance

Systems or system components that support mission-essential services or functions can be enhanced or strengthened to maximize the trustworthiness of the resource. Sometimes, this enhancement or strengthening is done at the design level. In other instances, it is done post-design, either through modifications of the system in question or by augmenting the system with additional components. For example, supplemental authentication or non-repudiation functions may be added to the system to enhance critical resources that depend on organization-defined resources. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

{{ insert: param, A.03.16.01E.ODP.01 }} is/are employed to {{ insert: param, A.03.16.01E.ODP.02 }} supporting mission-essential services or functions to increase the trustworthiness in those systems or components.

Assessment method

• System and services acquisition policy procedures addressing design modification, augmentation, or reconfiguration of systems or system components documented evidence of design modification, augmentation, or reconfiguration system security plan supply chain risk management plan other relevant documents or records

Assessment method

• Personnel with system and service acquisition responsibilities personnel with information security responsibilities personnel with security architecture responsibilities personnel with configuration management responsibilities

Assessment method

• Processes for the modification, design, augmentation, or reconfiguration of systems or system components mechanisms supporting and/or implementing design modification, augmentation, or reconfiguration of systems or system components