Navigate

CCI-004690

CCI-004690 Definition

Include the controls needed to satisfy privacy requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if: - controls needed to satisfy the security requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service. - controls needed to satisfy the privacy requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service.

Validation Procedures

Examine: [SELECT FROM: System and services acquisition policy; system and services acquisition procedures; procedures addressing the integration of information security and privacy and supply chain risk management into the acquisition process; configuration management plan; acquisition contracts for the system, system component, or system service; system design documentation; system security plan; supply chain risk management plan; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with acquisition/contracting responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators; organizational personnel with supply chain risk management responsibilities]. Test: [SELECT FROM: Organizational processes for determining system security and privacy functional, strength, and assurance requirements; organizational processes for developing acquisition contracts; mechanisms supporting and/or implementing acquisitions and the inclusion of security and privacy requirements in contracts].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-004690.

Control	Description
SA-4	Include the following requirements, descriptions, and criteria, explicitly or by reference, using [one or more of "standardized contract language"/"{{ insert: param, sa-04_odp.02 }} "] in the acquisition contract for the system, system component, or system service: a: Security and privacy functional requirements; b: Strength of mechanism requirements; c: Security and privacy assurance requirements; d: Controls needed to satisfy the security and privacy requirements. e: Security and privacy documentation requirements; f: Requirements for protecting security and privacy documentation; g: Description of the system development environment and environment in which the system is intended to operate; h: Allocation of responsibility or identification of parties responsible for information security, privacy, and supply chain risk management; and i: Acceptance criteria.

Control

Description

SA-4

Include the following requirements, descriptions, and criteria, explicitly or by reference, using [one or more of "standardized contract language"/"{{ insert: param, sa-04_odp.02 }} "] in the acquisition contract for the system, system component, or system service:

a: Security and privacy functional requirements;

b: Strength of mechanism requirements;

c: Security and privacy assurance requirements;

d: Controls needed to satisfy the security and privacy requirements.

e: Security and privacy documentation requirements;

f: Requirements for protecting security and privacy documentation;

g: Description of the system development environment and environment in which the system is intended to operate;

h: Allocation of responsibility or identification of parties responsible for information security, privacy, and supply chain risk management; and

i: Acceptance criteria.