organization to help eliminate similar vulnerabilities presence of unauthorized software on in other information systems (i.e., systemic organizational information system and weaknesses or deficiencies). notify designated organizational officials. System and Services Acquisition SA-1 The organization develops, disseminates, and System and Services reviews/updates [Assignment: organization-defined Acquisition Policy and frequency]: Procedures A formal, documented system and services acquisition policy that includes information security considerations and that addresses purpose, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Formal, documented procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls. SA-2 The organization: Allocation of Resources Includes a determination of information security requirements for the information system in mission/business process planning; Determines, documents, and allocates the resources required to protect the information system part of its capital planning and investment control process; and Establishes a discrete line item for information security in organizational programming and budgeting documentation. SA-3 The organization: Life Cycle Support Manages the information system using a system development life cycle methodology that includes information security considerations; Defines and documents information system security roles and responsibilities throughout the system development life cycle; and Identifies individuals having information system security roles and responsibilities. SA-4 The organization includes the following requirements (1) The organization requires in acquisition documents The organization requires in acquisition Acquisitions and/or specifications, explicitly or by reference, in that vendors/contractors provide information documents that vendors/contractors information system acquisition contracts on an describing the functional properties of the security provide information describing the assessment of risk and in accordance with applicable controls to be employed within the information design and implementation details of the federal laws, Executive Orders, directives, policies, system, information system components, or security controls to be deployed within regulations, and standards: information system services in sufficient detail to the information system components, or Security functional requirements/specifications; permit analysis and testing of the controls. information system services (including Security-related documentation requirements; and (4) The organization ensures that each information functional interfaces among control Developmental and evaluation-related assurance system component acquired is explicitly assigned to components) in sufficient detail to requirements. an information system, and that the owner of the permit analysis and testing of the system acknowledges this assignment. controls.
organization to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies). presence of unauthorized software on organizational information system and notify designated organizational officials. System and Services Acquisition SA-1 System and Services Acquisition Policy and Procedures The organization develops, disseminates, and reviews/updates [Assignment: organization-defined frequency]: A formal, documented system and services acquisition policy that includes information security considerations and that addresses purpose, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Formal, documented procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls. SA-2 Allocation of Resources The organization: Includes a determination of information security requirements for the information system in mission/business process planning; Determines, documents, and allocates the resources required to protect the information system part of its capital planning and investment control process; and Establishes a discrete line item for information security in organizational programming and budgeting documentation. SA-3 Life Cycle Support The organization: Manages the information system using a system development life cycle methodology that includes information security considerations; Defines and documents information system security roles and responsibilities throughout the system development life cycle; and Identifies individuals having information system security roles and responsibilities. SA-4 Acquisitions The organization includes the following requirements and/or specifications, explicitly or by reference, in information system acquisition contracts on an assessment of risk and in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards: Security functional requirements/specifications; Security-related documentation requirements; and Developmental and evaluation-related assurance requirements. (1) The organization requires in acquisition documents that vendors/contractors provide information describing the functional properties of the security controls to be employed within the information system, information system components, or information system services in sufficient detail to permit analysis and testing of the controls. (4) The organization ensures that each information system component acquired is explicitly assigned to an information system, and that the owner of the system acknowledges this assignment. The organization requires in acquisition documents that vendors/contractors provide information describing the design and implementation details of the security controls to be deployed within the information system components, or information system services (including functional interfaces among control components) in sufficient detail to permit analysis and testing of the controls.