Assessment Objective
Determine if:
- SA-09(03)[01] trust relationships with external service provides based on [Assignment: security requirements, properties, factors, or conditions] are established and documented;
- SA-09(03)[02] trust relationships with external service provides based on [Assignment: security requirements, properties, factors, or conditions] are maintained;
- SA-09(03)[03] trust relationships with external service provides based on [Assignment: privacy requirements, properties, factors, or conditions] are established and documented;
- SA-09(03)[04] trust relationships with external service provides based on [Assignment: privacy requirements, properties, factors, or conditions] are maintained.
Assessment Methods
Examine
- System and services acquisition policy
- system and services acquisition procedures
- acquisition contracts for the system, system component, or system service
- acquisition documentation
- solicitation documentation
- service level agreements
- memorandum of understanding
- memorandum of agreements
- list of organizational security and privacy requirements, properties, factors, or conditions for external provider services
- documentation of trust relationships with external service providers
- system security plan
- privacy plan
- supply chain risk management plan
- other relevant documents or records
Interview
- Organizational personnel with acquisition responsibilities
- organizational personnel with information security and privacy responsibilities
- external providers of system services
- organizational personnel with supply chain risk management responsibilities
Kwistjonijiet marbuta
| Tip ta’ link | Kwistjoni |
|---|---|
| blocks | SA-09(03) Establish and Maintain Trust Relationship with Providers |