View source for Comprehensive Guide to Developing and Implementing a Cybersecurity Plan/A simplified description of NIST Special Publication 800-53 controls, with ties to LIMSpec/Appendix 1.17 System and services acquisition

===Appendix 1.17  System and services acquisition===
====SA-1 Policy and procedures====
This control recommends the organization develop, document, disseminate, review, and update system and services acquisition policies and procedures. It asks organizations to not only address the purpose, scope, roles, responsibilities, and enforcement of system and services acquisition action but also to address how those policies and procedures will be implemented, reviewed, and updated. 

'''Additional resources''':
* [https://csrc.nist.gov/publications/detail/sp/800-12/rev-1/final NIST Special Publications 800-12, Rev. 1], page 69
* [https://csrc.nist.gov/publications/detail/sp/800-100/final NIST Special Publication 800-100], pages 113–23
* [https://www.limswiki.org/index.php/LII:LIMSpec/Maintaining_Laboratory_Workflow_and_Operations#7._Document_and_records_management LIMSpec 7.1, 7.2]

====SA-2 Allocation of resources====
This control recommends the organization determine, document, and allocate the resources required to protect the information system and its service as part of business process planning, capital planning, and cybersecurity planning. Those associated plans should have a discrete line item pertaining to information security.

'''Additional resources''':
* [https://web.archive.org/web/20170203203450/http://www.integritymc.com/blog/2015/06/why-cpic-matters-more-than-ever-to-cybersecurity/ Integrity Matters Why CPIC Matters More than Ever to Cybersecurity]
* No LIMSpec comp (organizational policy rather than system specification)

====SA-3 System development life cycle====
This control recommends the organization use a system development life cycle in the management of its information system. As part of this approach, the organization should define and document security roles and responsibilities for the phases of the life cycle, identify the key individuals involved, and ensure the organization's security risk management process is integrated into development life cycle activities. As such, the development life cycle benefits from consistency "with organizational risk management and information security strategies."

'''Additional resources''':
* [https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final NIST Special Publications 800-37, Rev. 2]
* No LIMSpec comp (organizational policy rather than system specification)

====SA-4 Acquisition process====
This control recommends the organization, as part of the acquisition process, include security functional, strength, and assurance requirements; requirements for security documentation and its protection; a description of the developmental and operational system environments; and acceptance criteria in the acquisition contracts for the information system, its components, and its services.

'''Additional resources''':
* [https://www.niap-ccevs.org/index.cfm? National Information Assurance Partnership]
* [https://csrc.nist.gov/publications/detail/sp/800-70/rev-4/final NIST Special Publication 800-70, Rev. 4]
* No LIMSpec comp (organizational policy rather than system specification)

====SA-4 (1) Acquisition process: Functional properties of controls====
This control enhancement recommends the organization require of an information system, system component, or software developer a description of the functional properties of the controls (i.e., the functionality visible at the interfaces of the security controls) the system, component, or software will employ. 

'''Additional resources''':
* [https://www.limswiki.org/index.php/LII:LIMSpec/Security_and_Integrity_of_Systems_and_Operations#33._System_validation_and_commission LIMSpec 33.4]

====SA-4 (2) Acquisition process: Design and implementation information for controls====
This control enhancement recommends the organization require of an information system, system component, or software developer information on the design and implementation of the controls inherent to the system, component, or software. This could include security-relevant external system interfaces, high-level design, low-level design, source code, or hardware schematics.

'''Additional resources''':
* [https://www.limswiki.org/index.php/LII:LIMSpec/Security_and_Integrity_of_Systems_and_Operations#33._System_validation_and_commission LIMSpec 33.2, 33.4]

====SA-4 (3) Acquisition process: Development methods, techniques, and practices====
This control enhancement recommends the organization require of an information system, system component, or software developer proof of using a development life cycle that includes current and relevant system and security engineering methods, software development methods, testing and validation techniques, and quality control procedures.

'''Additional resources''':
* [https://www.limswiki.org/index.php/LII:LIMSpec/Security_and_Integrity_of_Systems_and_Operations#33._System_validation_and_commission LIMSpec 33.1]

====SA-5 System documentation====
This control recommends the organization require of a system, system component, or software developer administrator documentation that describes configuration, installation, and operation; effective use and maintenance of security mechanisms; known vulnerabilities of privileged functions; best user practices to ensure system security; and administrator and user responsibilities for maintaining the security. The organization should document any attempts (and failures) to acquire such administrator documentation, protect that documentation internally, and distribute it to the appropriate personnel or roles.

'''Additional resources''':
* [https://www.limswiki.org/index.php/LII:LIMSpec/Security_and_Integrity_of_Systems_and_Operations#33._System_validation_and_commission LIMSpec 33.4]

====SA-9 External system services====
This control recommends the organization hold providers of external information system services accountable to organizational security requirements, as well as defined security controls. The organization should also document government oversight and user roles and responsibilities associated with the services. The organization should also monitor the external information system services provider for compliance with organizational security requirements and security controls.

'''Additional resources''':
* No LIMSpec comp (organizational policy rather than system specification)

====SA-16 Developer-provided training====
This control recommends the organization require of an information system, system component, or software developer specific training on the correct operation of the security functions, controls, and mechanisms of the system, system component, or software.

'''Additional resources''':
* [https://www.limswiki.org/index.php/LII:LIMSpec/Security_and_Integrity_of_Systems_and_Operations#34._System_administration LIMSpec 34.6]