// Level 3 · Controls

System and Services Acquisition

NIST SP 800-53 Rev 5 System and Services Acquisition controls.

Policy and Procedures

Develop, document, and disseminate to [parameter]:

Allocation of Resources

Determine the high-level information security and privacy requirements for the system or system service in mission and business process planning;

SA-03Medium

System Development Life Cycle

Acquire, develop, and manage the system using [parameter] that incorporates information security and privacy considerations;

SA-04Medium

Acquisition Process

Include the following requirements, descriptions, and criteria, explicitly or by reference, using [parameter] in the acquisition contract for the system, system component, or system service:

SA-05Medium

System Documentation

Obtain or develop administrator documentation for the system, system component, or system service that describes:

SA-06Medium

Security and Privacy Engineering Principles

Apply the following systems security and privacy engineering principles in the specification, design, development, implementation, and modification of the system and system components: [parameter].

SA-09Medium

External System Services

Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: [parameter];

SA-10Medium

Developer Configuration Management

Require the developer of the system, system component, or system service to:

SA-11Medium

Developer Testing and Evaluation

Require the developer of the system, system component, or system service, at all post-design stages of the system development life cycle, to:

SA-12Medium

Development Process, Standards, and Tools

Require the developer of the system, system component, or system service to follow a documented development process that:

SA-16Medium

Require the developer of the system, system component, or system service to provide the following training on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms: [parameter].

SA-17Medium

Developer Security and Privacy Architecture and Design

Require the developer of the system, system component, or system service to produce a design specification and security and privacy architecture that:

SA-18Medium