Assessment Objective

Determine if:

• SA-09(01)(a) an organizational assessment of risk is conducted prior to the acquisition or outsourcing of information security services;
• SA-09(01)(b) [Assignment: personnel or roles] approve the acquisition or outsourcing of dedicated information security services.

Assessment Methods

Examine

• System and services acquisition policy
• supply chain risk management policy and procedures
• procedures addressing external system services
• acquisition documentation
• acquisition contracts for the system, system component, or system service
• risk assessment reports
• approval records for the acquisition or outsourcing of dedicated security services
• system security plan
• supply chain risk management plan
• other relevant documents or records

Interview

• Organizational personnel with system and service acquisition responsibilities
• organizational personnel with system security responsibilities
• external providers of system services
• organizational personnel with information security responsibilities
• organizational personnel with supply chain risk management responsibilities

Test

• Organizational processes for conducting a risk assessment prior to acquiring or outsourcing dedicated security services
• organizational processes for approving the outsourcing of dedicated security services
• mechanisms supporting and/or implementing risk assessment
• mechanisms supporting and/or implementing approval processes

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final