SA-1 Policy and Procedures

a. Develop, document, and disseminate to organization-defined personnel or roles: 1. Selection (one or more): organization-level; mission/business process-level; system-level system and services acquisition policy that: (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2. Procedures to facilitate the implementation of the system and services acquisition policy and the associated system and services acquisition controls; b. Designate an organization-defined official to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures; and c. Review and update the current system and services acquisition: 1. Policy organization-defined frequency and following organization-defined events; and 2. Procedures organization-defined frequency and following organization-defined events.

Source: NIST SP 800-53 Rev 5, SA-1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open NIST SP 800-53 Rev 5 in the compliance library.

Base controls and their enhancements. Which apply follows the baseline you are assessed against (for example FedRAMP Moderate or High, or the low, moderate and high baselines of SP 800-53B). Text in square brackets is a parameter your organisation sets.