id: "SA-04(12)" title: "Data Ownership" family: "SA" family_name: "System and Services Acquisition" sort_id: "sa-04.12" priority: "P1" implementation_level: "organization" parent: "SA-04" enhancement: True
Include organizational data ownership requirements in the acquisition contract; and
Require all data to be removed from the contractor’s system and returned to the organization within {{ insert: param, sa-04.12_odp }}.
Guidance
Contractors who operate a system that contains data owned by an organization initiating the contract have policies and procedures in place to remove the data from their systems and/or return the data in a time frame defined by the contract.
Assessment Objective: organizational data ownership requirements are included in the acquisition contract;
Assessment Objective: all data to be removed from the contractor’s system and returned to the organization is required within {{ insert: param, sa-04.12_odp }}.
System and services acquisition policy
system and services acquisition procedures
procedures addressing the integration of information security and privacy requirements, descriptions, and criteria into the acquisition process
procedures addressing the disposition of personally identifiable information
solicitation documentation
acquisition documentation
acquisition contracts for the system or system service
personally identifiable information processing policy
service level agreements
information sharing agreements
memoranda of understanding
system security plan
privacy plan
privacy impact assessment
privacy risk assessment documentation
other relevant documents or records
Organizational personnel with acquisition/contracting responsibilities
organizational personnel with the responsibility for data management and processing requirements
organizational personnel with information security and privacy responsibilities
Contract management processes to verify that data is removed as required
vendor processes for removing data in required timeframe
mechanisms verifying the removal and return of data