+3.16 System and Services Acquisition
---+03.16.01E Specialization

3.16 System and Services Acquisition

System and Services Acquisition

1. Pārskats

03.16.01E Specialization

Statement

Employ {{ insert: param, A.03.16.01E.ODP.01 }} on {{ insert: param, A.03.16.01E.ODP.02 }} supporting mission-essential services or functions to increase the trustworthiness in those systems or components.

Guidance

Systems or system components that support mission-essential services or functions can be enhanced or strengthened to maximize the trustworthiness of the resource. Sometimes, this enhancement or strengthening is done at the design level. In other instances, it is done post-design, either through modifications of the system in question or by augmenting the system with additional components. For example, supplemental authentication or non-repudiation functions may be added to the system to enhance critical resources that depend on organization-defined resources. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Statement

  • (includes preempt) Ensure that the threat event does not have an impact.

    • Reduce likelihood of occurrence and/or reduce likelihood of impact.

    • The adversary’s efforts or resources cannot be applied or are wasted.

  • (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

    • Reduce likelihood of impact and reduce level of impact.

    • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

{{ insert: param, A.03.16.01E.ODP.01 }} is/are employed to {{ insert: param, A.03.16.01E.ODP.02 }} supporting mission-essential services or functions to increase the trustworthiness in those systems or components.

Assessment method

  • System and services acquisition policy procedures addressing design modification, augmentation, or reconfiguration of systems or system components documented evidence of design modification, augmentation, or reconfiguration system security plan supply chain risk management plan other relevant documents or records

Assessment method

  • Personnel with system and service acquisition responsibilities personnel with information security responsibilities personnel with security architecture responsibilities personnel with configuration management responsibilities

Assessment method

  • Processes for the modification, design, augmentation, or reconfiguration of systems or system components mechanisms supporting and/or implementing design modification, augmentation, or reconfiguration of systems or system components

1.1 Atsauces

1.2 Identificētās prasības

1.3 Saistītie tiesību akti

2. Identificētās prasības

Prasības

3. Saistītie tiesību akti

Tiesību akti
  • NIST -

    EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

    DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.