Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > Assessment Objective

SA-4 Acquisition Process - Assessment Objective
Determine if the following are satisfied:

SA-04a.[01] security functional requirements, descriptions, and criteria are included explicitly or by reference using [Selection; one or more: standardized contract language; [Assignment: organization-defined contract language] ] in the acquisition contract for the system, system component, or system service;
SA-04a.[02] privacy functional requirements, descriptions, and criteria are included explicitly or by reference using [Selection; one or more: standardized contract language; [Assignment: organization-defined contract language] ] in the acquisition contract for the system, system component, or system service;
SA-04b. strength of mechanism requirements, descriptions, and criteria are included explicitly or by reference using [Selection; one or more: standardized contract language; [Assignment: organization-defined contract language] ] in the acquisition contract for the system, system component, or system service;
SA-04c.[01] security assurance requirements, descriptions, and criteria are included explicitly or by reference using [Selection; one or more: standardized contract language; [Assignment: organization-defined contract language] ] in the acquisition contract for the system, system component, or system service;
SA-04c.[02] privacy assurance requirements, descriptions, and criteria are included explicitly or by reference using [Selection; one or more: standardized contract language; [Assignment: organization-defined contract language] ] in the acquisition contract for the system, system component, or system service;
SA-04d.[01] controls needed to satisfy the security requirements, descriptions, and criteria are included explicitly or by reference using [Selection; one or more: standardized contract language; [Assignment: organization-defined contract language] ] in the acquisition contract for the system, system component, or system service;
SA-04d.[02] controls needed to satisfy the privacy requirements, descriptions, and criteria are included explicitly or by reference using [Selection; one or more: standardized contract language; [Assignment: organization-defined contract language] ] in the acquisition contract for the system, system component, or system service;
SA-04e.[01] security documentation requirements, descriptions, and criteria are included explicitly or by reference using [Selection; one or more: standardized contract language; [Assignment: organization-defined contract language] ] in the acquisition contract for the system, system component, or system service;
SA-04e.[02] privacy documentation requirements, descriptions, and criteria are included explicitly or by reference using [Selection; one or more: standardized contract language; [Assignment: organization-defined contract language] ] in the acquisition contract for the system, system component, or system service;
SA-04f.[01] requirements for protecting security documentation, descriptions, and criteria are included explicitly or by reference using [Selection; one or more: standardized contract language; [Assignment: organization-defined contract language] ] in the acquisition contract for the system, system component, or system service;
SA-04f.[02] requirements for protecting privacy documentation, descriptions, and criteria are included explicitly or by reference using [Selection; one or more: standardized contract language; [Assignment: organization-defined contract language] ] in the acquisition contract for the system, system component, or system service;
SA-04g. the description of the system development environment and environment in which the system is intended to operate, requirements, and criteria are included explicitly or by reference using [Selection; one or more: standardized contract language; [Assignment: organization-defined contract language] ] in the acquisition contract for the system, system component, or system service;
SA-04h.[01] the allocation of responsibility or identification of parties responsible for information security requirements, descriptions, and criteria are included explicitly or by reference using [Selection; one or more: standardized contract language; [Assignment: organization-defined contract language] ] in the acquisition contract for the system, system component, or system service;
SA-04h.[02] the allocation of responsibility or identification of parties responsible for privacy requirements, descriptions, and criteria are included explicitly or by reference using [Selection; one or more: standardized contract language; [Assignment: organization-defined contract language] ];
SA-04h.[03] the allocation of responsibility or identification of parties responsible for supply chain risk management requirements, descriptions, and criteria are included explicitly or by reference using [Selection; one or more: standardized contract language; [Assignment: organization-defined contract language] ];
SA-04i. acceptance criteria requirements and descriptions are included explicitly or by reference using [Selection; one or more: standardized contract language; [Assignment: organization-defined contract language] ] in the acquisition contract for the system, system component, or system service.