SA-4 Acquisition Process
Include the following requirements, descriptions, and criteria, explicitly or by reference, using Selection (one or more): standardized contract language; [organization-defined contract language] in the acquisition contract for the system, system component, or system service: a. Security and privacy functional requirements; b. Strength of mechanism requirements; c. Security and privacy assurance requirements; d. Controls needed to satisfy the security and privacy requirements. e. Security and privacy documentation requirements; f. Requirements for protecting security and privacy documentation; g. Description of the system development environment and environment in which the system is intended to operate; h. Allocation of responsibility or identification of parties responsible for information security, privacy, and supply chain risk management; and i. Acceptance criteria.
Source: NIST SP 800-53 Rev 5, SA-4. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open NIST SP 800-53 Rev 5 in the compliance library.
Base controls and their enhancements. Which apply follows the baseline you are assessed against (for example FedRAMP Moderate or High, or the low, moderate and high baselines of SP 800-53B). Text in square brackets is a parameter your organisation sets.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Test of Organizational processes for determining system security and privacy functional, strength, and assurance requirements; organizational processes for developing acquisition contracts; mechanisms supporting and/or implementing acquisitions and the inclusion of security and privacy requirements in contr · Vendor register / contract repository
governing documentDocuments that govern the control
- System and services acquisition policy · Policy repository / GRC workspace
- System and services acquisition procedures · Policy repository / GRC workspace
- Procedures addressing the integration of information security and privacy and supply chain risk management into the acquisition process · Policy repository / GRC workspace
- Configuration management plan · Policy repository / GRC workspace
- Acquisition contracts for the system, system component, or system service · Vendor register / contract repository
- System design documentation · Document repository
- System security plan · Policy repository / GRC workspace
- Supply chain risk management plan · Policy repository / GRC workspace
- Privacy plan · Policy repository / GRC workspace
First move
Common gaps auditors find
- Acquisition contracts omit security and privacy functional, strength of mechanism and assurance requirements for the purchased system
- Contract language lacks acceptance criteria and documentation requirements for security and privacy deliverables from the supplier
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSA-3(3) System Development Life Cycle | Technology Refresh · SA-4(1) Acquisition Process | Functional Properties of Controls