Navigate

SA-9 (2)

SA-9 (2): Identification Of Functions / Ports / Protocols / Services

The organization requires providers of [Assignment: organization-defined external information system services] to identify the functions, ports, protocols, and other services required for the use of such services.

Supplemental

Information from external service providers regarding the specific functions, ports, protocols, and services used in the provision of such services can be particularly useful when the need arises to understand the trade-offs involved in restricting certain functions/services or blocking certain ports/protocols.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to SA-9 (2).

Control	Description
CM-7	The organization: CM-7a.: Configures the information system to provide only essential capabilities; and CM-7b.: Prohibits or restricts the use of the following functions, ports, protocols, and/or services: [Assignment: organization-defined prohibited or restricted functions, ports, protocols, and/or services].

Enhancements

The controls below (if any) add on to the requirements of SA-9 (2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to SA-9 (2).

CCI	Definition
CCI-003143	The organization requires providers of organization-defined external information system services to identify the functions, ports, protocols, and other services required for the use of such services.
CCI-003144	The organization defines the external information system services for which the providers are required to identify the functions, ports, protocols, and other services required for the use of such services.