Assessment Objective
Determine if:
- SA-04a.
- SA-04a.[01] security functional requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
- SA-04a.[02] privacy functional requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
- SA-04b. strength of mechanism requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
- SA-04c.
- SA-04c.[01] security assurance requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
- SA-04c.[02] privacy assurance requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
- SA-04d.
- SA-04d.[01] controls needed to satisfy the security requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
- SA-04d.[02] controls needed to satisfy the privacy requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
- SA-04e.
- SA-04e.[01] security documentation requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
- SA-04e.[02] privacy documentation requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
- SA-04f.
- SA-04f.[01] requirements for protecting security documentation, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
- SA-04f.[02] requirements for protecting privacy documentation, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
- SA-04g. the description of the system development environment and environment in which the system is intended to operate, requirements, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
- SA-04h.
- SA-04h.[01] the allocation of responsibility or identification of parties responsible for information security requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
- SA-04h.[02] the allocation of responsibility or identification of parties responsible for privacy requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ];
- SA-04h.[03] the allocation of responsibility or identification of parties responsible for supply chain risk management requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ];
- SA-04i. acceptance criteria requirements and descriptions are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service.
Assessment Methods
Examine
- System and services acquisition policy
- system and services acquisition procedures
- procedures addressing the integration of information security and privacy and supply chain risk management into the acquisition process
- configuration management plan
- acquisition contracts for the system, system component, or system service
- system design documentation
- system security plan
- supply chain risk management plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with acquisition/contracting responsibilities
- organizational personnel with information security and privacy responsibilities
- system/network administrators
- organizational personnel with supply chain risk management responsibilities
Test
- Organizational processes for determining system security and privacy functional, strength, and assurance requirements
- organizational processes for developing acquisition contracts
- mechanisms supporting and/or implementing acquisitions and the inclusion of security and privacy requirements in contracts
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | SA-04 [P] Acquisition Process |