id: "SA-10(07)" title: "Security and Privacy Representatives" family: "SA" family_name: "System and Services Acquisition" sort_id: "sa-10.07" priority: "P1" implementation_level: "organization" parent: "SA-10" enhancement: True
Statement
Require {{ insert: param, sa-10.7_prm_1 }} to be included in the {{ insert: param, sa-10.7_prm_2 }}.
Guidance
Information security and privacy representatives can include system security officers, senior agency information security officers, senior agency officials for privacy, and system privacy officers. Representation by personnel with information security and privacy expertise is important because changes to system configurations can have unintended side effects, some of which may be security- or privacy-relevant. Detecting such changes early in the process can help avoid unintended, negative consequences that could ultimately affect the security and privacy posture of systems. The configuration change management and control process in this control enhancement refers to the change management and control process defined by organizations in SA-10b.
Assessment Objective: {{ insert: param, sa-10.07_odp.01 }} are required to be included in the {{ insert: param, sa-10.07_odp.03 }};
Assessment Objective: {{ insert: param, sa-10.07_odp.02 }} are required to be included in the {{ insert: param, sa-10.07_odp.04 }}.
System and services acquisition policy
system and services acquisition procedures
configuration management policy
configuration management plan
solicitation documentation requiring representatives for security and privacy
acquisition documentation
service level agreements
acquisition contracts for the system, system component, or system service
system developer configuration management plan
change control records
configuration management records
system security plan
other relevant documents or records
Organizational personnel with system and service acquisition responsibilities
organizational personnel with information security and privacy responsibilities
organizational personnel with configuration management responsibilities
system developers