Navigate

SA-2

SA-2: Allocation Of Resources

The organization:

SA-2a.: Determines information security requirements for the information system or information system service in mission/business process planning;

SA-2b.: Determines, documents, and allocates the resources required to protect the information system or information system service as part of its capital planning and investment control process; and

SA-2c.: Establishes a discrete line item for information security in organizational programming and budgeting documentation.

Supplemental

Resource allocation for information security includes funding for the initial information system or information system service acquisition and funding for the sustainment of the system/service.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
Privacy (High), Privacy (Low), Privacy (Mod)

Related Controls

The controls below (if any) were marked by NIST as being related to SA-2.

Control	Description
PM-3	The organization: PM-3a.: Ensures that all capital planning and investment requests include the resources needed to implement the information security program and documents all exceptions to this requirement; PM-3b.: Employs a business case/Exhibit 300/Exhibit 53 to record the resources required; and PM-3c.: Ensures that information security resources are available for expenditure as planned.
PM-11	The organization: PM-11a.: Defines mission/business processes with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and PM-11b.: Determines information protection needs arising from the defined mission/business processes and revises the processes as necessary, until achievable protection needs are obtained.

Control

Description

PM-3

The organization:

PM-3a.: Ensures that all capital planning and investment requests include the resources needed to implement the information security program and documents all exceptions to this requirement;

PM-3b.: Employs a business case/Exhibit 300/Exhibit 53 to record the resources required; and

PM-3c.: Ensures that information security resources are available for expenditure as planned.

PM-11

The organization:

PM-11a.: Defines mission/business processes with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and

PM-11b.: Determines information protection needs arising from the defined mission/business processes and revises the processes as necessary, until achievable protection needs are obtained.

Enhancements

The controls below (if any) add on to the requirements of SA-2.

Control	Description
No controls

Related CCIs

The CCIs below are tied to SA-2.

CCI	Definition
CCI-000610	The organization determines the resources required to protect the information system or information system service as part of its capital planning and investment control process.
CCI-000611	The organization documents the resources required to protect the information system or information system service as part of its capital planning and investment control process.
CCI-000612	The organization allocates the resources required to protect the information system or information system service as part of its capital planning and investment control process.
CCI-000613	The organization establishes a discrete line item for information security in organizational programming documentation.
CCI-000614	The organization establishes a discrete line item for information security in organizational budgeting documentation.
CCI-003091	The organization determines information security requirements for the information system or information system service in mission/business process planning.