id: "SA-02" title: "Allocation of Resources" family: "SA" family_name: "System and Services Acquisition" sort_id: "sa-02" priority: "P1" implementation_level: "organization"
Determine the high-level information security and privacy requirements for the system or system service in mission and business process planning;
Determine, document, and allocate the resources required to protect the system or system service as part of the organizational capital planning and investment control process; and
Establish a discrete line item for information security and privacy in organizational programming and budgeting documentation.
Guidance
Resource allocation for information security and privacy includes funding for system and services acquisition, sustainment, and supply chain-related risks throughout the system development life cycle.
Assessment Objective: the high-level information security requirements for the system or system service are determined in mission and business process planning;
Assessment Objective: the high-level privacy requirements for the system or system service are determined in mission and business process planning;
Assessment Objective: the resources required to protect the system or system service are determined and documented as part of the organizational capital planning and investment control process;
Assessment Objective: the resources required to protect the system or system service are allocated as part of the organizational capital planning and investment control process;
Assessment Objective: a discrete line item for information security is established in organizational programming and budgeting documentation;
Assessment Objective: a discrete line item for privacy is established in organizational programming and budgeting documentation.
System and services acquisition policy
system and services acquisition procedures
system and services acquisition strategy and plans
procedures addressing the allocation of resources to information security and privacy requirements
procedures addressing capital planning and investment control
organizational programming and budgeting documentation
system security plan
privacy plan
supply chain risk management policy
other relevant documents or records
Organizational personnel with capital planning, investment control, organizational programming, and budgeting responsibilities
organizational personnel with information security and privacy responsibilities
organizational personnel with supply chain risk management responsibilities
Organizational processes for determining information security and privacy requirements
organizational processes for capital planning, programming, and budgeting
mechanisms supporting and/or implementing organizational capital planning, programming, and budgeting