NIST SP 800-53 Rev. 5 · SA-4

Acquisition Process

US National Institute of Standards and Technology (NIST) · cited in 5 of our lessons

What it asks for. Acquisition contracts must include, explicitly or by reference, security and privacy functional requirements, strength and assurance requirements, controls, documentation, development environment and acceptance criteria, among other defined items.

In practice. This means standard security clauses and requirements in procurement templates, security review before contracts are signed and acceptance testing against those requirements. Requirements should scale with the criticality of what is bought. Auditors expect procurement templates, evidence of security involvement in purchasing decisions and acceptance records. DORA contractual requirements for ICT services are a related European reference. Software bills of materials and vulnerability handling commitments are increasingly requested.

Common gaps. Security is often brought in after the contract is signed, when leverage is gone. Requirements are generic and not tested at acceptance. Cloud services bought on standard terms leave little room for negotiation.

Open SP 800-53 at NIST

The official text

Include the following requirements, descriptions, and criteria, explicitly or by reference, using [Selection: standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service: a. Security and privacy functional requirements; b. Strength of mechanism requirements; c. Security and privacy assurance requirements; d. Controls needed to satisfy the security and privacy requirements. e. Security and privacy documentation requirements; f. Requirements for protecting security and privacy documentation; g. Description of the system development environment and environment in which the system is intended to operate; h. Allocation of responsibility or identification of parties responsible for information security, privacy, and supply chain risk management; and i. Acceptance criteria. Discussion: Security and privacy functional requirements are typically derived from the high-level security and privacy requirements described in [SA-2](#sa-2) . The derived requirements include security and privacy capabilities, functions, and mechanisms. Strength requirements associated with such capabilities, functions, and mechanisms include degree of correctness, completeness, resistance to tampering or bypass, and resistance to direct attack. Assurance requirements include development processes, procedures, and methodologies as well as the evidence from development and assessment activities that provide grounds for confidence that the required functionality is implemented and possesses the required strength of mechanism. [SP 800-160-1](#e3cc0520-a366-4fc9-abc2-5272db7e3564) describes the process of requirements engineering as part of the system development life cycle. Controls can be viewed as descriptions of the safeguards and protection capabilities appropriate for achieving the particular security and privacy objectives of the organization and for reflecting the security and privacy requirements of stakeholders. Controls are selected and implemented in order to satisfy system requirements and include developer and organizational responsibilities. Controls can include technical, administrative, and physical aspects. In some cases, the selection and implementation of a control may necessitate additional specification by the organization in the form of derived requirements or instantiated control parameter values. The derived requirements and control parameter values may be necessary to provide the appropriate level of implementation detail for controls within the system development life cycle. Security and privacy documentation requirements address all stages of the system development life cycle. Documentation provides user and administrator guidance for the implementation and operation of controls. The level of detail required in such documentation is based on the security categorization or classification level of the system and the degree to which organizations depend on the capabilities, functions, or mechanisms to meet risk response expectations. Requirements can include mandated configuration settings that specify allowed functions, ports, protocols, and services. Acceptance criteria for systems, system components, and system services are defined in the same manner as the criteria for any organizational acquisition or procurement. Organizations can determine other requirements that support security and operations, to include responsibilities for the organization and developer, and notification and timing requirements for support, maintenance and updates.

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered.