SA-2 Allocation of Resources
Determine the high-level information security and privacy requirements for the system or system service in mission and business process planning; determine, document and allocate the resources required to protect the system or system service as part of the organizational capital planning and investment control process; and establish a discrete line item for information security and privacy in organizational programming and budgeting documentation.
Source: FedRAMP High (NIST SP 800-53 Rev 5 baseline), SA-2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open FedRAMP High (NIST SP 800-53 Rev 5 baseline) in the compliance library.
A FedRAMP baseline is a subset of NIST SP 800-53 Rev 5, enhancements included.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Records of review of the allocation when requirements or the system change across the system development life cycle · Document repository
governing documentDocuments that govern the control
- Mission and business process planning documentation recording the high-level information security and privacy requirements determined for the system or system service · Policy repository / GRC workspace
- Capital planning and investment control submission or business case showing the resources determined, documented and allocated to protect the system or system service · Document repository
- Programming and budgeting documentation showing a discrete line item for information security and privacy · Policy repository / GRC workspace
- Approved budget or spend plan carrying that line item, with its approval record · Policy repository / GRC workspace
- System security and privacy plan section recording the allocated resources and the basis for the amount · Policy repository / GRC workspace
First move
Common gaps auditors find
- Security and privacy requirements determined after the acquisition decision rather than during mission and business process planning
- Security funding absorbed into a general IT or infrastructure line, so no discrete information security and privacy item exists to evidence
- Resources named in a plan but never traced through to an approved budget or capital planning submission
- Privacy resourcing omitted while security resourcing is documented, although the control covers both
- Line item established once at authorization and not maintained through sustainment and supply chain activity
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSA-1 Policy and Procedures · SA-3 System Development Life Cycle