Eleos | Home

System and Services Acquisition (SA)

Acquisition Process | NIAP-approved Protection Profiles

Level N/A

(a) Limit the use of commercially provided information assurance and information assurance-enabled information technology products to those products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists; and (b) Require, if no NIAP-approved Protection Profile exists for a specific technology type but a commercially provided information technology product relies on cryptographic functionality to enforce its security policy, that the cryptographic module is FIPS-validated or NSA-approved.

Parent

Compliance Framework

NIST 800-53 Rev 5

Control Number

SA-4(7)

Related

Compliance Framework

Secure Controls Framework 2023.4

Control Number

TDA-02.2

Solutions
Community

System and Services Acquisition (SA)

Acquisition Process | Continuous Monitoring Plan for Controls

Level N/A

Require the developer of the system, system component, or system service to produce a plan for continuous monitoring of control effectiveness that is consistent with the continuous monitoring program of the organization.

Parent

Compliance Framework

NIST 800-53 Rev 5

Control Number

SA-4(8)

Related

Compliance Framework

CCM v4.0.10

Secure Controls Framework 2023.4

Control Number

AIS-04

TDA-09.1

Solutions
Community

System and Services Acquisition (SA)

Acquisition Process | Functions, Ports, Protocols, and Services in Use

Level N/A

Require the developer of the system, system component, or system service to identify the functions, ports, protocols, and services intended for organizational use.

Parent

Compliance Framework

NIST 800-53 Rev 5

Control Number

SA-4(9)

Related

Compliance Framework

CCM v4.0.10

Secure Controls Framework 2023.4

Control Number

AIS-04

STA-01

STA-09

TDA-02.1

Solutions
Community

System and Services Acquisition (SA)

Acquisition Process | Use of Approved PIV Products

Level N/A

Employ only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational systems.

Parent

Compliance Framework

NIST 800-53 Rev 5

Control Number

SA-4(10)

Related

Compliance Framework

CCM v4.0.10

Secure Controls Framework 2023.4

Control Number

STA-01

STA-09

TDA-02.2

Solutions
Community

System and Services Acquisition (SA)

Acquisition Process | System of Records

Level N/A

Include [Assignment: organization-defined Privacy Act requirements] in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mission or function.

Parent

Compliance Framework

NIST 800-53 Rev 5

Control Number

SA-4(11)

Related

Compliance Framework

CCM v4.0.10

Control Number

IPY-04

STA-06

Solutions
Community

System and Services Acquisition (SA)

Acquisition Process | Data Ownership

Level N/A

(a) Include organizational data ownership requirements in the acquisition contract; and (b) Require all data to be removed from the contractor’s system and returned to the organization within [Assignment: organization-defined time frame].

Parent

Compliance Framework

NIST 800-53 Rev 5

Control Number

SA-4(12)

Related

Compliance Framework

CCM v4.0.10

Secure Controls Framework 2023.4

Control Number

IPY-04

AST-03

DCH-01.1

PRI-09

Solutions
Community

System and Services Acquisition (SA)

System Documentation

Level N/A

a. Obtain or develop administrator documentation for the system, system component, or system service that describes: 1. Secure configuration, installation, and operation of the system, component, or service; 2. Effective use and maintenance of security and privacy functions and mechanisms; and 3. Known vulnerabilities regarding configuration and use of administrative or privileged functions; b. Obtain or develop user documentation for the system, system component, or system service that describes: 1. User-accessible security and privacy functions and mechanisms and how to effectively use those functions and mechanisms; 2. Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner and protect individual privacy; and 3. User responsibilities in maintaining the security of the system, component, or service and privacy of individuals; c. Document attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent and take [Assignment: organization-defined actions] in response; and d. Distribute documentation to [Assignment: organization-defined personnel or roles].

Parent

Compliance Framework

NIST 800-53 Rev 5

Control Number

SA-5

Related

Compliance Framework

CCM v4.0.10

Secure Controls Framework 2023.4

Control Number

AIS-04

DSP-05

DSP-07

AST-04.1

TDA-04

Solutions
Community

System and Services Acquisition (SA)

Supply Chain Protection | Acquisition Strategies / Tools / Methods

Level N/A

[Withdrawn: Moved to SR-5.]

Solutions
Community

System and Services Acquisition (SA)

Supply Chain Protection | Validate as Genuine and Not Altered

Level N/A

[Withdrawn: Moved to SR-4(3).]

Solutions
Community

System and Services Acquisition (SA)

Supply Chain Protection | Penetration Testing / Analysis of Elements, Processes, and Actors

Level N/A

[Withdrawn: Moved to SR-6(1).]

Solutions
Community

System and Services Acquisition (SA)

Create new POAM

Create new Exception

Assign to POAM

Assign to Exception

System and Services Acquisition (SA)

Create new POAM

Create new Exception

Assign to POAM

Assign to Exception

System and Services Acquisition (SA)

Create new POAM

Create new Exception

Assign to POAM

Assign to Exception

System and Services Acquisition (SA)

Create new POAM

Create new Exception

Assign to POAM

Assign to Exception

System and Services Acquisition (SA)

Create new POAM

Create new Exception

Assign to POAM

Assign to Exception

System and Services Acquisition (SA)

Create new POAM

Create new Exception

Assign to POAM

Assign to Exception

System and Services Acquisition (SA)

Create new POAM

Create new Exception

Assign to POAM

Assign to Exception

System and Services Acquisition (SA)

Create new POAM

Create new Exception

Assign to POAM

Assign to Exception

System and Services Acquisition (SA)

Create new POAM

Create new Exception

Assign to POAM

Assign to Exception

System and Services Acquisition (SA)

Create new POAM

Create new Exception

Assign to POAM

Assign to Exception

Organization Passcode

Only share this code with people you trust. Users will become a member of your organization and view your SSP and reports.