Agency SSR Response: IRS Response: 9.3.15.7 SA-9: External Information System Services Describe how the agency requires that providers of external information system services comply with agency information security requirements and employ to include (at a minimum) security requirements contained within this publication and applicable federal laws, Executive Orders, directives, policies, regulations, standards, and established service-level agreements. Include how the agency: Defines and documents government oversight and user roles and responsibilities with regard to external information system services Monitors security control compliance by external service providers on an ongoing basis Restricts the location of information systems that receive, process, store, or transmit FTI to areas within the United States territories, embassies, or military installations (CE5) Note: Agencies must prohibit the use of non-agency-owned information systems, system components, or devices that receive, process, store, or transmit FTI unless explicitly approved by the Office of Safeguards. For notification requirements, refer to Section 7.4.5, Non-Agency-Owned Information Systems, of Publication 1075. The contract for the acquisition must contain Exhibit 7 language, as appropriate (see Section 9.3.15.4, Acquisition Process (SA-4), and Exhibit 7, Safeguarding Contract Language). Agency SSR Response: IRS Response: 9.3.15.8 SA-10: Developer Configuration Management Describe how the agency requires the developer of the information system, system component, or information system service to: Perform configuration management during system, component, or service development, implementation, and operation Document, manage, and control the integrity of changes to the system, component, or service Implement only agency-approved changes to the system, component, or service Document approved changes to the system, component, or service and the potential security impacts of such changes Track security flaws and flaw resolution within the system, component, or service and report findings to designated agency officials Agency SSR Response:
Agency SSR Response: IRS Response: 9.3.15.7 SA-9: External Information System Services Describe how the agency requires that providers of external information system services comply with agency information security requirements and employ to include (at a minimum) security requirements contained within this publication and applicable federal laws, Executive Orders, directives, policies, regulations, standards, and established service-level agreements. Include how the agency: Defines and documents government oversight and user roles and responsibilities with regard to external information system services Monitors security control compliance by external service providers on an ongoing basis Restricts the location of information systems that receive, process, store, or transmit FTI to areas within the United States territories, embassies, or military installations (CE5) Note: Agencies must prohibit the use of non-agency-owned information systems, system components, or devices that receive, process, store, or transmit FTI unless explicitly approved by the Office of Safeguards. For notification requirements, refer to Section 7.4.5, Non-Agency-Owned Information Systems, of Publication 1075. The contract for the acquisition must contain Exhibit 7 language, as appropriate (see Section 9.3.15.4, Acquisition Process (SA-4), and Exhibit 7, Safeguarding Contract Language). Agency SSR Response: IRS Response: 9.3.15.8 SA-10: Developer Configuration Management Describe how the agency requires the developer of the information system, system component, or information system service to: Perform configuration management during system, component, or service development, implementation, and operation Document, manage, and control the integrity of changes to the system, component, or service Implement only agency-approved changes to the system, component, or service Document approved changes to the system, component, or service and the potential security impacts of such changes Track security flaws and flaw resolution within the system, component, or service and report findings to designated agency officials Agency SSR Response: