Navigate

SA-4(6)

SA-4(6): Use of Information Assurance Products

The organization:

(a): Employs only government off-the-shelf (GOTS) or commercial off-the-shelf (COTS) information assurance (IA) and IA-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted; and

(b): Ensures that these products have been evaluated and/or validated by NSA or in accordance with NSA-approved procedures.

Supplemental

COTS IA or IA-enabled information technology products used to protect classified information by cryptographic means may be required to use NSA-approved key management.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to SA-4(6).

Control	Description
SC-8	The information system protects the [one or more of confidentiality/integrity] of transmitted information.
SC-12	The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with [organization-defined requirements for key generation, distribution, storage, access, and destruction].
SC-13	The information system implements [organization-defined cryptographic uses and type of cryptography required for each use] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

Enhancements

The controls below (if any) add on to the requirements of SA-4(6).

Control	Description
No controls

Related CCIs

The CCIs below are tied to SA-4(6).

CCI	Definition
CCI-000631	Employ only government off-the-shelf or commercial off-the-shelf information assurance and information assurance-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted.
CCI-000633	Ensure that government off-the-shelf or commercial-off-the-shelf information assurance and information assurance-enabled information technology products have been evaluated and/or validated by NSA or in accordance with NSA-approved procedures.