Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- TDA-02_A01 a system and services acquisition policy is developed and documented.
Assessment rigor: 1
Origin: 53A_R5_SA-01a.[01] - TDA-02_A02 system and services acquisition procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls are developed and documented.
Assessment rigor: 1
Origin: 53A_R5_SA-01a.[03] - TDA-02_A03 acquisition strategies, contract tools, and procurement methods are implemented to identify supply chain risks.
Assessment rigor: 1
Origin: 171A_R3_A.03.17.02[04] - TDA-02_A04 acquisition strategies, contract tools, and procurement methods are implemented to protect against supply chain risks.
Assessment rigor: 1
Origin: 171A_R3_A.03.17.02[05] - TDA-02_A05 acquisition strategies, contract tools, and procurement methods are implemented to mitigate supply chain risks.
Assessment rigor: 1
Origin: 171A_R3_A.03.17.02[06] - TDA-02_A06 personnel or roles to whom the system and services acquisition policy is to be disseminated is/are defined.
Assessment rigor: 3
Origin: 53A_R5_SA-01_ODP[01] - TDA-02_A07 personnel or roles to whom the system and services acquisition procedures are to be disseminated is/are defined.
Assessment rigor: 3
Origin: 53A_R5_SA-01_ODP[02] - TDA-02_A08 one or more of the following organization-defined criteria is/are selected: {organization-level. mission/business process-level. system-level}.
Assessment rigor: 3
Origin: 53A_R5_SA-01_ODP[03] - TDA-02_A09 an official to manage the system and services acquisition policy and procedures is defined.
Assessment rigor: 3
Origin: 53A_R5_SA-01_ODP[04] - TDA-02_A10 the frequency at which the current system and services acquisition policy is reviewed / updated is defined.
Defined parameters: at least annually, and upon significant change
Assessment rigor: 3
Origin: 53A_R5_SA-01_ODP[05] - TDA-02_A11 events that would require the current system and services acquisition policy to be reviewed / updated are defined.
Defined parameters: significant changes
Assessment rigor: 3
Origin: 53A_R5_SA-01_ODP[06] - TDA-02_A12 the frequency at which the current system and services acquisition procedures are reviewed / updated is defined.
Defined parameters: at least annually, and upon significant change
Assessment rigor: 3
Origin: 53A_R5_SA-01_ODP[07] - TDA-02_A13 events that would require the system and services acquisition procedures to be reviewed / updated are defined.
Defined parameters: significant changes
Assessment rigor: 3
Origin: 53A_R5_SA-01_ODP[08] - TDA-02_A14 the system and services acquisition policy is disseminated to organization-defined personnel or roles.
Assessment rigor: 3
Origin: 53A_R5_SA-01a.[02] - TDA-02_A15 the system and services acquisition procedures are disseminated to organization-defined personnel or roles.
Assessment rigor: 3
Origin: 53A_R5_SA-01a.[04] - TDA-02_A16 the organization's system and services acquisition policy addresses purpose.
Assessment rigor: 3
Origin: 53A_R5_SA-01a.01(a)[01] - TDA-02_A17 the organization's system and services acquisition policy addresses scope.
Assessment rigor: 3
Origin: 53A_R5_SA-01a.01(a)[02] - TDA-02_A18 the organization's system and services acquisition policy addresses roles.
Assessment rigor: 3
Origin: 53A_R5_SA-01a.01(a)[03] - TDA-02_A19 the organization's system and services acquisition policy addresses responsibilities.
Assessment rigor: 3
Origin: 53A_R5_SA-01a.01(a)[04] - TDA-02_A20 the organization's system and services acquisition policy addresses management commitment.
Assessment rigor: 3
Origin: 53A_R5_SA-01a.01(a)[05] - TDA-02_A21 the organization's system and services acquisition policy addresses coordination among organizational entities.
Assessment rigor: 3
Origin: 53A_R5_SA-01a.01(a)[06] - TDA-02_A22 the organization's system and services acquisition policy addresses compliance.
Assessment rigor: 3
Origin: 53A_R5_SA-01a.01(a)[07] - TDA-02_A23 the organization's system and services acquisition policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
Assessment rigor: 3
Origin: 53A_R5_SA-01a.01(b) - TDA-02_A24 the organization-defined official is designated to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures.
Assessment rigor: 3
Origin: 53A_R5_SA-01b. - TDA-02_A25 the system and services acquisition policy is reviewed / updated organization-defined frequency.
Defined parameters: at least annually, and upon significant change
Assessment rigor: 3
Origin: 53A_R5_SA-01c.01[01] - TDA-02_A26 the current system and services acquisition policy is reviewed / updated following organization-defined events.
Defined parameters: significant changes
Assessment rigor: 3
Origin: 53A_R5_SA-01c.01[02] - TDA-02_A27 the current system and services acquisition procedures are reviewed / updated organization-defined frequency.
Defined parameters: at least annually, and upon significant change
Assessment rigor: 3
Origin: 53A_R5_SA-01c.02[01] - TDA-02_A28 the current system and services acquisition procedures are reviewed / updated following organization-defined events.
Defined parameters: significant changes
Assessment rigor: 3
Origin: 53A_R5_SA-01c.02[02] - TDA-02_A29 systems or system components supporting mission-essential services or functions are defined.
Assessment rigor: 3
Origin: 53A_R5_SA-23_ODP[01] 53A_R5_SA-23_ODP[02] - TDA-02_A30 organization's is employed on organization-defined systems or system components supporting essential services or functions to increase the trustworthiness in those systems or components.
Assessment rigor: 3
Origin: 53A_R5_SA-23 - TDA-02_A31 systems security engineering principles to be applied to the development or modification of the system and system components are defined.
Assessment rigor: 2
Origin: 171A_R3_A.03.16.01.ODP[01] - TDA-02_A32 Technology Development & Acquisition (TDA) operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
Assessment rigor: 1
Origin: SCF Created - TDA-02_A33 adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support Technology Development & Acquisition (TDA) operations.
Assessment rigor: 1
Origin: SCF Created - TDA-02_A34 responsibility and authority for the performance of Technology Development & Acquisition (TDA)-related activities are assigned to designated personnel.
Assessment rigor: 1
Origin: SCF Created - TDA-02_A35 personnel performing Technology Development & Acquisition (TDA)-related activities have the skills and knowledge needed to perform their assigned duties.
Assessment rigor: 2
Origin: SCF Created
Tickets liés
| Type de lien | Ticket |
|---|---|
| blocks | Technology Development & Acquisition |
- Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.
DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.