NIST SP 800-53A

Special Publication 800-53A

Guide for Assessing the Security Controls in

Federal Information Systems and Organizations

APPENDIX F-RA

PAGE F-231

Special Publication 800-53A

Guide for Assessing the Security Controls in

Federal Information Systems and Organizations

APPENDIX F-RA

PAGE F-232

Special Publication 800-53A

Guide for Assessing the Security Controls in

Federal Information Systems and Organizations

APPENDIX F-RA

PAGE F-233

Special Publication 800-53A

Guide for Assessing the Security Controls in

Federal Information Systems and Organizations

FAMILY: SYSTEM AND SERVICES ACQUISITION

CLASS: MANAGEMENT

ASSESSMENT PROCEDURE

SA-1

SYSTEM AND SERVICES ACQUISITION POLICY AND PROCEDURES

SA-1.1

ASSESSMENT OBJECTIVE:

Determine if:

(i)

the organization develops and formally documents system services and acquisition

policy;

(ii)

the organization system services and acquisition policy addresses:

-

purpose;

-

scope;

-

roles and responsibilities;

-

management commitment;

- coordination among organizational entities; and

-

compliance;

(iii)

the organization disseminates formal documented system services and acquisition

policy to elements within the organization having associated system services and

acquisition roles and responsibilities;

(iv)

the organization develops and formally documents system services and acquisition

procedures;

(v)

the organization system services and acquisition procedures facilitate

implementation of the system and services acquisition policy and associated system

services and acquisition controls; and

(vi)

the organization disseminates formal documented system services and acquisition

procedures to elements within the organization having associated system services

and acquisition roles and responsibilities.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy and procedures; other relevant

documents or records].

Interview: [SELECT FROM: Organizational personnel with system and services acquisition

responsibilities].

SA-1.2

ASSESSMENT OBJECTIVE:

Determine if:

(i)

the organization defines the frequency of system services and acquisition policy

reviews/updates;

(ii)

the organization reviews/updates system services and acquisition policy in

accordance with organization-defined frequency; and

(iii) the organization defines the frequency of system services and acquisition procedure

reviews/updates;

(iv) the organization reviews/updates system services and acquisition procedures in

accordance with organization-defined frequency.

APPENDIX F-SA

PAGE F-234

Special Publication 800-53A

Guide for Assessing the Security Controls in

Federal Information Systems and Organizations

FAMILY: SYSTEM AND SERVICES ACQUISITION

CLASS: MANAGEMENT

ASSESSMENT PROCEDURE

SA-2

ALLOCATION OF RESOURCES

SA-2.1

ASSESSMENT OBJECTIVE:

Determine if:

(i)

the organization includes a determination of the information security requirements

for the information system in mission/business process planning;

(ii)

the organization determines, documents, and allocates the resources required to

protect the information system as part of its capital planning and investment control

process; and

(iii)

the organization establishes a discrete line item for information security in

organizational programming and budgeting documentation.

APPENDIX F-SA

PAGE F-235

Special Publication 800-53A

Guide for Assessing the Security Controls in

Federal Information Systems and Organizations

FAMILY: SYSTEM AND SERVICES ACQUISITION

CLASS: MANAGEMENT

ASSESSMENT PROCEDURE

SA-3

LIFE CYCLE SUPPORT

SA-3.1

ASSESSMENT OBJECTIVE:

Determine if:

(i)

the organization manages the information system using a system development life

cycle methodology that includes information security considerations;

(ii)

the organization defines and documents information system security roles and

responsibilities throughout the system development life cycle; and

(iii)

the organization identifies individuals having information system security roles and

responsibilities.

APPENDIX F-SA

PAGE F-236

Special Publication 800-53A

Guide for Assessing the Security Controls in

Federal Information Systems and Organizations

FAMILY: SYSTEM AND SERVICES ACQUISITION

CLASS: MANAGEMENT

ASSESSMENT PROCEDURE

SA-4

ACQUISITIONS

SA-4.1

ASSESSMENT OBJECTIVE:

Determine if the organization includes the following requirements and/or specifications,

explicitly or by reference, in information system acquisition contracts based on an

assessment of risk and in accordance with applicable federal laws, Executive Orders,

directives, policies, regulations, and standards:

- security functional requirements/specifications;

- security-related documentation requirements; and

- developmental and evaluation-related assurance requirements.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing the

integration of information security requirements and/or security specifications into the

acquisition process; acquisition contracts for information systems or services; other relevant

documents or records].

Interview: [SELECT FROM: Organizational personnel with information system security, acquisition, and

contracting responsibilities].

SA-4(1)

ACQUISITIONS

SA-4(1).1

ASSESSMENT OBJECTIVE:

Determine if the organization requires in acquisition documents that vendors/contractors

provide information describing in the functional properties of the security controls to be

employed within the information system, information system components, or information

system services in sufficient detail to permit analysis and testing of the controls.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing the

integration of information security requirements and/or security specifications into the

acquisition process; solicitation documents; acquisition documentation; acquisition contracts

for information systems or services; other relevant documents or records].

SA-4(2)

ACQUISITIONS

SA-4(2).1

ASSESSMENT OBJECTIVE:

Determine if the organization requires in acquisition documents that vendors/contractors

provide information describing the design and implementation details of the security

controls to be employed within the information system, information system components, or

information system services (including functional interfaces among control components)

in sufficient detail to permit analysis and testing of the controls.

APPENDIX F-SA

PAGE F-237

Special Publication 800-53A

Guide for Assessing the Security Controls in

Federal Information Systems and Organizations

SA-4(3)

ACQUISITIONS

SA-4(3).1

ASSESSMENT OBJECTIVE:

Determine if the organization requires software vendors/manufacturers to minimize

flawed or malformed software by demonstrating that their software development

processes employ:

- state-of-the-practice software and security engineering methods;

- quality control processes; and

-

validation techniques.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing the

integration of information security requirements and/or security specifications into the

acquisition process; solicitation documents; acquisition documentation; acquisition contracts

for information systems or services; other relevant documents or records].

SA-4(4)

ACQUISITIONS

SA-4(4).1

ASSESSMENT OBJECTIVE:

Determine if:

(i) the organization explicitly assigns each acquired information system component to an

information system; and

(ii)

the owner of the system acknowledges each assignment of information system

components to the information system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing the

integration of information security requirements and/or security specifications into the

acquisition process; solicitation documents; acquisition documentation; acquisition contracts

for information systems or services; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with information system security, acquisition, and

contracting responsibilities; information system owner].

SA-4(5)

ACQUISITIONS

SA-4(5).1

ASSESSMENT OBJECTIVE:

Determine if:

(i) the organization requires in acquisition documents that information system

components are delivered in a secure, documented configuration; and

(ii) the organization requires in acquisition documents that the secure configuration is

the default configuration for any software reinstalls or upgrades.

APPENDIX F-SA

PAGE F-238

Special Publication 800-53A

Guide for Assessing the Security Controls in

Federal Information Systems and Organizations

SA-4(6)

ACQUISITIONS

SA-4(6).1

ASSESSMENT OBJECTIVE:

Determine if:

(i)

the organization employs only government off-the-shelf (GOTS) or commercial off-

the-shelf (COTS) information assurance (IA) and IA-enabled information technology

products that compose an NSA-approved solution to protect classified information

when the networks used to transmit the information are at a lower classification

level than the information being transmitted; and

(ii)

the organization ensures that these products have been evaluated and/or validated

by the NSA or in accordance with NSA-approved procedures.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing the

integration of information security requirements and/or security specifications into the

acquisition process; solicitation documents; acquisition documentation; acquisition contracts

for information systems or services; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with information system security, acquisition, and

contracting responsibilities].

SA-4(7)

ACQUISITIONS

SA-4(7).1

ASSESSMENT OBJECTIVE:

Determine if:

(i)

the organization limits the use of commercially-provided information technology

products to those products that have been successfully evaluated against a validated

U.S. Government Protection Profile for a specific technology type, if such a profile

exists;

(ii)

the organization requires a commercially-provided information technology product

to rely on cryptographic functionality to enforce its security policy when no U.S.

Government Protection Profile exists for such a specific technology type; and

(iii)

the organization requires the use of a FIPS-validated, cryptographic module for a

technology product that relies on cryptographic functionality to enforce its security

policy when no U.S. Government Protection Profile exists for such a specific

technology type.

APPENDIX F-SA

PAGE F-239

Special Publication 800-53A

Guide for Assessing the Security Controls in

Federal Information Systems and Organizations

FAMILY: SYSTEM AND SERVICES ACQUISITION

CLASS: MANAGEMENT

ASSESSMENT PROCEDURE

SA-5

INFORMATION SYSTEM DOCUMENTATION

SA-5.1

ASSESSMENT OBJECTIVE:

Determine if:

(i) the organization obtains, protects as required, and makes available to authorized

personnel, administrator documentation for the information system that describes:

- secure configuration, installation, and operation of the information system;

- effective use and maintenance of the security features/functions; and

- known vulnerabilities regarding configuration and use of administrative (i.e.,

privileged) functions;

(ii) the organization obtains, protects as required, and makes available to authorized

personnel, user documentation for the information system that describes:

- user-accessible security features/functions and how to effectively use those

security features/functions;

- methods for user interaction with the information system, which enables

individuals to use the system in a more secure manner; and

- user responsibilities in maintaining the security of the information and

information system; and

(iii) the organization documents attempts to obtain information system documentation

when such documentation is either unavailable or nonexistent.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing information

system documentation; information system documentation including administrator and user

guides; records documenting attempts to obtain unavailable or nonexistent information

system documentation; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with information system documentation

responsibilities; organizational personnel operating, using, and/or maintaining the

information system].

SA-5(1)

INFORMATION SYSTEM DOCUMENTATION

SA-5(1).1

ASSESSMENT OBJECTIVE:

Determine if the organization obtains, protects as required, and makes available to

authorized personnel, vendor/manufacturer documentation that describes the functional

properties of the security controls employed within the information system with sufficient

detail to permit analysis and testing.

APPENDIX F-SA

PAGE F-240