SA-7 User-Installed Software CONTROL Withdrawn: Incorporated into CM-11 and SI-7 REQUIREMENT SA-8 Security Engineering Principles SYSTEM The organization applies information system security CONTROL engineering principles in the specification, design, REQUIREMENT development, implementation, and modification of the information system. Implementation Status: Implemented Planned Common text in order to provide detailed information regarding the implementation strategy. If control is specific to one component of an application, then controls for the other components of the application must be identified individually. SA-9 External Information systems Services SYSTEM The organization: a. Requires that providers of external information system services comply with organizational information CONTROL security requirements and employ appropriate security REQUIREMENT controls in accordance with applicable Commonwealth laws, Executive Orders, directives, policies, regulations, standards, and guidance;
SA-7 User-Installed Software CONTROL REQUIREMENT Withdrawn: Incorporated into CM-11 and SI-7 SA-8 Security Engineering Principles SYSTEM CONTROL REQUIREMENT The organization applies information system security engineering principles in the specification, design, development, implementation, and modification of the information system. Implementation Status: Implemented Planned Common text in order to provide detailed information regarding the implementation strategy. If control is specific to one component of an application, then controls for the other components of the application must be identified individually. SA-9 External Information systems Services SYSTEM CONTROL REQUIREMENT The organization: a. Requires that providers of external information system services comply with organizational information security requirements and employ appropriate security controls in accordance with applicable Commonwealth laws, Executive Orders, directives, policies, regulations, standards, and guidance;
SSP_FINAL.docx