---

id: "SA-04(01)" title: "Functional Properties of Controls" family: "SA" family_name: "System and Services Acquisition" sort_id: "sa-04.01" priority: "P1" implementation_level: "organization" parent: "SA-04" enhancement: True

---

Statement

Require the developer of the system, system component, or system service to provide a description of the functional properties of the controls to be implemented.

Guidance

Functional properties of security and privacy controls describe the functionality (i.e., security or privacy capability, functions, or mechanisms) visible at the interfaces of the controls and specifically exclude functionality and data structures internal to the operation of the controls.

Assessment Objective

the developer of the system, system component, or system service is required to provide a description of the functional properties of the controls to be implemented.

System and services acquisition policy

system and services acquisition procedures

procedures addressing the integration of security and privacy requirements, descriptions, and criteria into the acquisition process

solicitation documents

acquisition documentation

acquisition contracts for the system, system component, or system services

system security plan

privacy plan

other relevant documents or records

Organizational personnel with acquisition/contracting responsibilities

organizational personnel with information security and privacy responsibilities

system developers

Organizational processes for determining system security functional requirements

organizational processes for developing acquisition contracts

mechanisms supporting and/or implementing acquisitions and the inclusion of security and privacy requirements in contracts