Navigate

SA-4 (6)

SA-4 (6): Use Of Information Assurance Products

The organization:

SA-4 (6)(a): Employs only government off-the-shelf (GOTS) or commercial off-the-shelf (COTS) information assurance (IA) and IA-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted; and

SA-4 (6)(b): Ensures that these products have been evaluated and/or validated by NSA or in accordance with NSA-approved procedures.

Supplemental

COTS IA or IA-enabled information technology products used to protect classified information by cryptographic means may be required to use NSA-approved key management.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
Classified, Int-A, Int-B, Int-C

Related Controls

The controls below (if any) were marked by NIST as being related to SA-4 (6).

Control	Description
SC-8	The information system protects the [Selection (one or more): confidentiality; integrity] of transmitted information.
SC-12	The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction].
SC-13	The information system implements [Assignment: organization-defined cryptographic uses and type of cryptography required for each use] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

Enhancements

The controls below (if any) add on to the requirements of SA-4 (6).

Control	Description
No controls

Related CCIs

The CCIs below are tied to SA-4 (6).

CCI	Definition
CCI-000631	The organization employs only government off-the-shelf (GOTS) or commercial off-the-shelf (COTS) information assurance (IA) and IA-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted.
CCI-000633	The organization ensures that government off-the-shelf (GOTS) or commercial-off-the-shelf(COTS) information assurance (IA) and IA-enabled information technology products have been evaluated and/or validated by the NSA or in accordance with NSA-approved procedures.