Navigate

CCI-003089

CCI-003089 Definition

Defines the personnel or roles to whom the organization-level; mission/business process-level; and/or system-level system and services acquisition policy is disseminated.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Validation Procedures

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-003089.

Control	Description
SA-1	The organization: a: Develops, documents, and disseminates to [one of ]: 1: A system and services acquisition policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and 2: Procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls; and b: Reviews and updates the current: 1: System and services acquisition policy [one of ]; and 2: System and services acquisition procedures [one of ].

Control

Description

SA-1

The organization:

a: Develops, documents, and disseminates to [one of ]:
- 1: A system and services acquisition policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
- 2: Procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls; and

b: Reviews and updates the current:
- 1: System and services acquisition policy [one of ]; and
- 2: System and services acquisition procedures [one of ].