SA-9(1)
SA-9(1): Risk Assessments / Organizational Approvals
The organization:
- (a): Conducts an organizational assessment of risk prior to the acquisition or outsourcing of dedicated information security services; and
- (b): Ensures that the acquisition or outsourcing of dedicated information security services is approved by [organization-defined personnel or roles].
Supplemental
Dedicated information security services include, for example, incident monitoring, analysis and response, operation of information security-related devices such as firewalls, or key management services.
| CIA Levels | |
|---|---|
| Confidentiality | unknown |
| Integrity | high |
| Availability | unknown |
| Overlays |
|---|
| None |
| CSF Categories |
|---|
| None |