Navigate

SA-9

SA-9: External Information System Services

The organization:

SA-9a.: Requires that providers of external information system services comply with organizational information security requirements and employ [Assignment: organization-defined security controls] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance;

SA-9b.: Defines and documents government oversight and user roles and responsibilities with regard to external information system services; and

SA-9c.: Employs [Assignment: organization-defined processes, methods, and techniques] to monitor security control compliance by external service providers on an ongoing basis.

Supplemental

External information system services are services that are implemented outside of the authorization boundaries of organizational information systems. This includes services that are used by, but not a part of, organizational information systems. FISMA and OMB policy require that organizations using external service providers that are processing, storing, or transmitting federal information or operating information systems on behalf of the federal government ensure that such providers meet the same security requirements that federal agencies are required to meet. Organizations establish relationships with external service providers in a variety of ways including, for example, through joint ventures, business partnerships, contracts, interagency agreements, lines of business arrangements, licensing agreements, and supply chain exchanges. The responsibility for managing risks from the use of external information system services remains with authorizing officials. For services external to organizations, a chain of trust requires that organizations establish and retain a level of confidence that each participating provider in the potentially complex consumer-provider relationship provides adequate protection for the services rendered. The extent and nature of this chain of trust varies based on the relationships between organizations and the external providers. Organizations document the basis for trust relationships so the relationships can be monitored over time. External information system services documentation includes government, service providers, end user security roles and responsibilities, and service-level agreements. Service-level agreements define expectations of performance for security controls, describe measurable outcomes, and identify remedies and response requirements for identified instances of noncompliance.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
Privacy (PHI)

Related Controls

The controls below (if any) were marked by NIST as being related to SA-9.

Control	Description
CA-3	The organization: CA-3a.: Authorizes connections from the information system to other information systems through the use of Interconnection Security Agreements; CA-3b.: Documents, for each interconnection, the interface characteristics, security requirements, and the nature of the information communicated; and CA-3c.: Reviews and updates Interconnection Security Agreements [Assignment: organization-defined frequency].
IR-7	The organization provides an incident response support resource, integral to the organizational incident response capability that offers advice and assistance to users of the information system for the handling and reporting of security incidents.
PS-7	The organization: PS-7a.: Establishes personnel security requirements including security roles and responsibilities for third-party providers; PS-7b.: Requires third-party providers to comply with personnel security policies and procedures established by the organization; PS-7c.: Documents personnel security requirements; PS-7d.: Requires third-party providers to notify [Assignment: organization-defined personnel or roles] of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges within [Assignment: organization-defined time period]; and PS-7e.: Monitors provider compliance.

Enhancements

The controls below (if any) add on to the requirements of SA-9.

Control	Description
SA-9 (1)	The organization: SA-9 (1)(a): Conducts an organizational assessment of risk prior to the acquisition or outsourcing of dedicated information security services; and SA-9 (1)(b): Ensures that the acquisition or outsourcing of dedicated information security services is approved by [Assignment: organization-defined personnel or roles].
SA-9 (2)	The organization requires providers of [Assignment: organization-defined external information system services] to identify the functions, ports, protocols, and other services required for the use of such services.
SA-9 (3)	The organization establishes, documents, and maintains trust relationships with external service providers based on [Assignment: organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships].
SA-9 (4)	The organization employs [Assignment: organization-defined security safeguards] to ensure that the interests of [Assignment: organization-defined external service providers] are consistent with and reflect organizational interests.
SA-9 (5)	The organization restricts the location of [Selection (one or more): information processing; information/data; information system services] to [Assignment: organization-defined locations] based on [Assignment: organization-defined requirements or conditions].

Related CCIs

The CCIs below are tied to SA-9.

CCI	Definition
CCI-000669	The organization requires that providers of external information system services comply with organizational information security requirements.
CCI-000670	The organization requires that providers of external information system services employ organization-defined security controls in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
CCI-000671	The organization defines government oversight with regard to external information system services.
CCI-000672	The organization documents government oversight with regard to external information system services.
CCI-000673	The organization defines user roles and responsibilities with regard to external information system services.
CCI-000674	The organization documents user roles and responsibilities with regard to external information system services.
CCI-003137	The organization defines security controls that providers of external information system services employ in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
CCI-003138	The organization employs organization-defined processes, methods, and techniques to monitor security control compliance by external service providers on an ongoing basis.
CCI-003139	The organization defines processes, methods, and techniques to employ to monitor security control compliance by external service providers on an ongoing basis.