id: "SA-23" title: "Specialization" family: "SA" family_name: "System and Services Acquisition" sort_id: "sa-23" priority: "P1" implementation_level: "organization"
Statement
Employ {{ insert: param, sa-23_odp.01 }} on {{ insert: param, sa-23_odp.02 }} supporting mission essential services or functions to increase the trustworthiness in those systems or components.
Guidance
It is often necessary for a system or system component that supports mission-essential services or functions to be enhanced to maximize the trustworthiness of the resource. Sometimes this enhancement is done at the design level. In other instances, it is done post-design, either through modifications of the system in question or by augmenting the system with additional components. For example, supplemental authentication or non-repudiation functions may be added to the system to enhance the identity of critical resources to other resources that depend on the organization-defined resources.
Assessment Objective
{{ insert: param, sa-23_odp.01 }} is employed on {{ insert: param, sa-23_odp.02 }} supporting essential services or functions to increase the trustworthiness in those systems or components.
System and services acquisition policy
procedures addressing design modification, augmentation, or reconfiguration of systems or system components
documented evidence of design modification, augmentation, or reconfiguration
system security plan
supply chain risk management plan
other relevant documents or records
Organizational personnel with system and service acquisition responsibilities
organizational personnel with information security responsibilities
organizational personnel with the responsibility for security architecture
organizational personnel responsible for configuration management
Organizational processes for the modification of design, augmentation, or reconfiguration of systems or system components
mechanisms supporting and/or implementing design modification, augmentation, or reconfiguration of systems or system components