Assessment Objective
Determine if:
- SA-09(04) [Assignment: actions] are taken to verify that the interests of [Assignment: external service providers] are consistent with and reflect organizational interests.
Assessment Methods
Examine
- System and services acquisition policy
- procedures addressing external system services
- acquisition contracts for the system, system component, or system service
- solicitation documentation
- acquisition documentation
- service level agreements
- organizational security requirements/safeguards for external service providers
- personnel security policies for external service providers
- assessments performed on external service providers
- system security plan
- supply chain risk management plan
- other relevant documents or records
Interview
- Organizational personnel with system and service acquisition responsibilities
- organizational personnel with information security responsibilities
- external providers of system services
- organizational personnel with supply chain risk management responsibilities
Test
- Organizational processes for defining and employing safeguards to ensure consistent interests with external service providers
- mechanisms supporting and/or implementing safeguards to ensure consistent interests with external service providers
Powiązane zgłoszenia
| Typ powiązania | Zgłoszenie |
|---|---|
| blocks | SA-09(04) Consistent Interests of Consumers and Providers |