Navigate

SA-2

SA-2: Allocation of Resources

The organization:

a: Determines information security requirements for the information system or information system service in mission/business process planning;

b: Determines, documents, and allocates the resources required to protect the information system or information system service as part of its capital planning and investment control process; and

c: Establishes a discrete line item for information security in organizational programming and budgeting documentation.

Supplemental

Resource allocation for information security includes funding for the initial information system or information system service acquisition and funding for the sustainment of the system/service.

CIA Levels
Confidentiality	high
Integrity	high
Availability	high

Overlays
Privacy (High), Privacy (Low), Privacy (Mod)

CSF Categories
ID.GV-4

Related Controls

The controls below (if any) were marked by NIST as being related to SA-2.

Control	Description
PM-3	The organization: a: Ensures that all capital planning and investment requests include the resources needed to implement the information security program and documents all exceptions to this requirement; b: Employs a business case/Exhibit 300/Exhibit 53 to record the resources required; and c: Ensures that information security resources are available for expenditure as planned.
PM-11	The organization: a: Defines mission/business processes with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and b: Determines information protection needs arising from the defined mission/business processes and revises the processes as necessary, until achievable protection needs are obtained.

Control

Description

PM-3

The organization:

a: Ensures that all capital planning and investment requests include the resources needed to implement the information security program and documents all exceptions to this requirement;

b: Employs a business case/Exhibit 300/Exhibit 53 to record the resources required; and

c: Ensures that information security resources are available for expenditure as planned.

PM-11

The organization:

a: Defines mission/business processes with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and

b: Determines information protection needs arising from the defined mission/business processes and revises the processes as necessary, until achievable protection needs are obtained.

Enhancements

The controls below (if any) add on to the requirements of SA-2.

Control	Description
No controls

Related CCIs

The CCIs below are tied to SA-2.

CCI	Definition
CCI-000610	Determine the resources required to protect the system or system service as part of the organizational capital planning and investment control process.
CCI-000611	Document the resources required to protect the system or system service as part of the organizational capital planning and investment control process.
CCI-000612	Allocate the resources required to protect the system or system service as part of the organizational capital planning and investment control process.
CCI-000613	Establish a discrete line item for information security in organizational programming documentation.
CCI-000614	Establish a discrete line item for information security in organizational budgeting documentation.
CCI-003091	Determine the high-level information security requirements for the system or system service in mission and business process planning.