Navigate

CCI-000603

CCI-000603 Definition

Disseminate to organization-defined personnel or roles an organization-level; mission/business process-level; and/or system-level system and services acquisition policy.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Validation Procedures

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000603.

Control	Description
SA-1	The organization: a: Develops, documents, and disseminates to [one of ]: 1: A system and services acquisition policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and 2: Procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls; and b: Reviews and updates the current: 1: System and services acquisition policy [one of ]; and 2: System and services acquisition procedures [one of ].

Control

Description

SA-1

The organization:

a: Develops, documents, and disseminates to [one of ]:
- 1: A system and services acquisition policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
- 2: Procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls; and

b: Reviews and updates the current:
- 1: System and services acquisition policy [one of ]; and
- 2: System and services acquisition procedures [one of ].