800-53 · SA System and Services Acquisition
SA-4
Acquisition Process
frameworkNIST SP 800-53 Rev 5.2
sectionSA System and Services Acquisition
csf 2.0DE.CM-06 GV.SC-05 GV.SC-06 GV.SC-07 GV.SC-08 GV.SC-09 GV.SC-10 ID.AM-08 ID.IM-03 ID.RA-09
topicsVendor Risk Mgmt
frameworks6 4 0
Official textInclude the following requirements, descriptions, and criteria, explicitly or by reference, using [Selection (one or more): standardized contract language; [Assignment: organization-defined contract language] ] in the acquisition contract for the system, system component, or system service:
a. Security and privacy functional requirements;
b. Strength of mechanism requirements;
c. Security and privacy assurance requirements;
d. Controls needed to satisfy the security and privacy requirements.
e. Security and privacy documentation requirements;
f. Requirements for protecting security and privacy documentation;
g. Description of the system development environment and environment in which the system is intended to operate;
h. Allocation of responsibility or identification of parties responsible for information security, privacy, and supply chain risk management; and
i. Acceptance criteria.NIST SP 800-53 Rev 5.2 control statement (public domain)
a. Security and privacy functional requirements;
b. Strength of mechanism requirements;
c. Security and privacy assurance requirements;
d. Controls needed to satisfy the security and privacy requirements.
e. Security and privacy documentation requirements;
f. Requirements for protecting security and privacy documentation;
g. Description of the system development environment and environment in which the system is intended to operate;
h. Allocation of responsibility or identification of parties responsible for information security, privacy, and supply chain risk management; and
i. Acceptance criteria.NIST SP 800-53 Rev 5.2 control statement (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.CM-06GV.SC-04GV.SC-06GV.SC-07ID.RA-10 | External service provider activities and services are monitored to find potentially adverse events; Suppliers are known and prioritized by criticality… | Crosswalk | Same topic: Vendor Risk Mgmt6 loosely related (not mappings)GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties Only shares CSF GV.SC-05: related, not a mapping GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Only shares CSF GV.SC-08: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Only shares CSF GV.SC-09: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Only shares CSF GV.SC-10: related, not a mapping ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles Only shares CSF ID.AM-08: related, not a mapping ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use Only shares CSF ID.RA-09: related, not a mapping |
| ISO 27001 | A.5.19A.5.20A.5.22A.5.8A.5.23A.8.28A.8.29A.8.30Clause 8.1 | Information security in supplier relationships; Addressing information security within supplier agreements… | Crosswalk | Same topic: Vendor Risk Mgmt NIST SP 800-53 → ISO 27001 mapping 15 loosely related (not mappings)A.5.31 Legal, statutory, regulatory and contractual requirements Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping Clause 6.1.2 Information security risk assessment Only shares CSF GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping A.5.21 Managing information security in the ICT supply chain Only shares CSF GV.SC-09, GV.SC-10: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF GV.SC-05, GV.SC-06: related, not a mapping Clause 6.1.3 Information security risk treatment Only shares CSF GV.SC-07, GV.SC-10: related, not a mapping A.5.9 Inventory of information and other associated assets Only shares CSF ID.AM-08: related, not a mapping …and 7 more in the downloads |
| CIS v8.1 | CIS 15.1CIS 15.3CIS 15.5CIS 15.6CIS 15.4CIS 15.7 | Establish and Maintain an Inventory of Service Providers; Classify Service Providers… | Crosswalk | Same topic: Vendor Risk Mgmt10 loosely related (not mappings)CIS 1.1 Establish and Maintain Detailed Enterprise Asset Inventory Only shares CSF ID.AM-08: related, not a mapping CIS 15.2 Establish and Maintain a Service Provider Management Policy Only shares CSF DE.CM-06: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Only shares CSF ID.AM-08: related, not a mapping …and 2 more in the downloads |
| SOC 2 | CC9.2 | Managing vendor and business partner risk | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)1 loosely related (not mappings)CC6.1 Logical access security over information assets Only shares CSF ID.AM-08: related, not a mapping |
| PCI DSS | 12.8.112.8.212.8.312.8.412.8.5 | List of third-party service providers kept; Written agreements with service providers… | Crosswalk | Same topic: Vendor Risk Mgmt30 loosely related (not mappings)1.2.4 Accurate account-data flow diagram maintained Only shares CSF GV.SC-06, GV.SC-07, GV.SC-08, GV.SC-10: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Only shares CSF GV.SC-07, GV.SC-09, GV.SC-10, ID.RA-09: related, not a mapping 1.2.3 Accurate network diagram maintained Only shares CSF GV.SC-06, GV.SC-08, GV.SC-10: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Only shares CSF GV.SC-07, GV.SC-09, ID.AM-08: related, not a mapping 6.3.3 Security patches installed promptly Only shares CSF GV.SC-09, ID.AM-08, ID.IM-03: related, not a mapping 11.6.1 Payment page changes and tampering detected Only shares CSF GV.SC-07, GV.SC-09, ID.AM-08: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Only shares CSF GV.SC-09, GV.SC-10, ID.AM-08: related, not a mapping 12.5.2 PCI DSS scope confirmed annually and on change Only shares CSF GV.SC-06, GV.SC-07, GV.SC-10: related, not a mapping …and 22 more in the downloads |
| CMMC | RA.L2-3.11.1CA.L2-3.12.3CA.L2-3.12.4CM.L2-3.4.9 | Risk Assessments; Security Control Monitoring… | No mapping. Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07, GV.SC-09…: related, not a mapping+9 more loosely related (not mappings)…and 5 more in the downloads | |
| HIPAA | §164.308(b)(1)§164.314(a)§164.308(b)(4)§164.314(a)(2)(i)§164.314(a)(2)(iii) | Business Associate Contracts and Other Arrangements; Business Associate Contracts or Other Arrangements… | Crosswalk | Same topic: Vendor Risk Mgmt NIST HIPAA → SP 800-53 crosswalk 24 loosely related (not mappings)§164.314(a)(2)(ii) Other Arrangements Only shares CSF DE.CM-06, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Only shares CSF DE.CM-06, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.308(a)(1)(ii)(B) Risk Management Only shares CSF GV.SC-09, GV.SC-10, ID.AM-08, ID.IM-03: related, not a mapping §164.316(a) Policies and Procedures Only shares CSF GV.SC-09, GV.SC-10, ID.AM-08, ID.IM-03: related, not a mapping §164.308(a)(1)(ii)(A) Risk Analysis Only shares CSF GV.SC-09, GV.SC-10, ID.IM-03: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF DE.CM-06, ID.IM-03: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Only shares CSF DE.CM-06, ID.IM-03: related, not a mapping …and 16 more in the downloads |
| GDPR | Art.28(1)Art.28(3) | Processor; Processor | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)1 loosely related (not mappings) |
| NIS2 | 5.15.26.1 | Supply chain security policy; Directory of suppliers and service providers… | Crosswalk | Same topic: Vendor Risk Mgmt5 loosely related (not mappings) |
| Essential Eight | ISM-1807 | An automated method of asset discovery is used at least fortnightly to support the… | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| DORA | Art.28(3)Art.28(4)Art.28(5)Art.28(8)Art.30(2)Art.30(3) | General principles; General principles… | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)6 loosely related (not mappings)Art.29(1) Preliminary assessment of ICT concentration risk at entity level Only shares CSF GV.SC-05, GV.SC-09, ID.RA-09: related, not a mapping Art.29(2) Preliminary assessment of ICT concentration risk at entity level Only shares CSF GV.SC-05, GV.SC-09, ID.RA-09: related, not a mapping |
| CPS 234 | Para 16Para 22Para 28Para 34 | Assess third parties' information security capability; Evaluate the design of third parties' controls… | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)1 loosely related (not mappings)Para 20 Classify information assets by criticality and sensitivity Only shares CSF ID.AM-08: related, not a mapping |
| Cyber Essentials | CE 3 | Security Update Management | No mapping. Only shares CSF ID.AM-08: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.