id: "SA-09" title: "External System Services" family: "SA" family_name: "System and Services Acquisition" sort_id: "sa-09" priority: "P1" implementation_level: "organization" enhancements: - sa-9.1 - sa-9.2 - sa-9.3 - sa-9.4 - sa-9.5 - sa-9.6 - sa-9.7 - sa-9.8
Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: {{ insert: param, sa-09_odp.01 }};
Define and document organizational oversight and user roles and responsibilities with regard to external system services; and
Employ the following processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis: {{ insert: param, sa-09_odp.02 }}.
Guidance
External system services are provided by an external provider, and the organization has no direct control over the implementation of the required controls or the assessment of control effectiveness. Organizations establish relationships with external service providers in a variety of ways, including through business partnerships, contracts, interagency agreements, lines of business arrangements, licensing agreements, joint ventures, and supply chain exchanges. The responsibility for managing risks from the use of external system services remains with authorizing officials. For services external to organizations, a chain of trust requires that organizations establish and retain a certain level of confidence that each provider in the consumer-provider relationship provides adequate protection for the services rendered. The extent and nature of this chain of trust vary based on relationships between organizations and the external providers. Organizations document the basis for the trust relationships so that the relationships can be monitored. External system services documentation includes government, service providers, end user security roles and responsibilities, and service-level agreements. Service-level agreements define the expectations of performance for implemented controls, describe measurable outcomes, and identify remedies and response requirements for identified instances of noncompliance.
Assessment Objective: providers of external system services comply with organizational security requirements;
Assessment Objective: providers of external system services comply with organizational privacy requirements;
Assessment Objective: providers of external system services employ {{ insert: param, sa-09_odp.01 }};
Assessment Objective: organizational oversight with regard to external system services are defined and documented;
Assessment Objective: user roles and responsibilities with regard to external system services are defined and documented;
Assessment Objective: {{ insert: param, sa-09_odp.02 }} are employed to monitor control compliance by external service providers on an ongoing basis.
System and services acquisition policy
system and services acquisition procedures
procedures addressing methods and techniques for monitoring control compliance by external service providers of system services
acquisition documentation
contracts
service level agreements
interagency agreements
licensing agreements
list of organizational security and privacy requirements for external provider services
control assessment results or reports from external providers of system services
system security plan
privacy plan
supply chain risk management plan
other relevant documents or records
Organizational personnel with acquisition responsibilities
external providers of system services
organizational personnel with information security and privacy responsibilities
organizational personnel with supply chain risk management responsibilities
Organizational processes for monitoring security and privacy control compliance by external service providers on an ongoing basis
mechanisms for monitoring security and privacy control compliance by external service providers on an ongoing basis