[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsa-4":3},{"item":4,"lessons":18,"controls":40,"related":68},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","sa-4","SA-4","Acquisition Process",5,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Acquisition contracts must include, explicitly or by reference, security and privacy functional requirements, strength and assurance requirements, controls, documentation, development environment and acceptance criteria, among other defined items.\n\n**In practice.** This means standard security clauses and requirements in procurement templates, security review before contracts are signed and acceptance testing against those requirements. Requirements should scale with the criticality of what is bought. Auditors expect procurement templates, evidence of security involvement in purchasing decisions and acceptance records. DORA contractual requirements for ICT services are a related European reference. Software bills of materials and vulnerability handling commitments are increasingly requested.\n\n**Common gaps.** Security is often brought in after the contract is signed, when leverage is gone. Requirements are generic and not tested at acceptance. Cloud services bought on standard terms leave little room for negotiation.","Include the following requirements, descriptions, and criteria, explicitly or by reference, using [Selection: standardized contract language; {{ insert: param, sa-04_odp.02 }} ] in the acquisition contract for the system, system component, or system service:\n  a. Security and privacy functional requirements;\n  b. Strength of mechanism requirements;\n  c. Security and privacy assurance requirements;\n  d. Controls needed to satisfy the security and privacy requirements.\n  e. Security and privacy documentation requirements;\n  f. Requirements for protecting security and privacy documentation;\n  g. Description of the system development environment and environment in which the system is intended to operate;\n  h. Allocation of responsibility or identification of parties responsible for information security, privacy, and supply chain risk management; and\n  i. Acceptance criteria.\nDiscussion: Security and privacy functional requirements are typically derived from the high-level security and privacy requirements described in [SA-2](#sa-2) . The derived requirements include security and privacy capabilities, functions, and mechanisms. Strength requirements associated with such capabilities, functions, and mechanisms include degree of correctness, completeness, resistance to tampering or bypass, and resistance to direct attack. Assurance requirements include development processes, procedures, and methodologies as well as the evidence from development and assessment activities that provide grounds for confidence that the required functionality is implemented and possesses the required strength of mechanism. [SP 800-160-1](#e3cc0520-a366-4fc9-abc2-5272db7e3564) describes the process of requirements engineering as part of the system development life cycle.\n\nControls can be viewed as descriptions of the safeguards and protection capabilities appropriate for achieving the particular security and privacy objectives of the organization and for reflecting the security and privacy requirements of stakeholders. Controls are selected and implemented in order to satisfy system requirements and include developer and organizational responsibilities. Controls can include technical, administrative, and physical aspects. In some cases, the selection and implementation of a control may necessitate additional specification by the organization in the form of derived requirements or instantiated control parameter values. The derived requirements and control parameter values may be necessary to provide the appropriate level of implementation detail for controls within the system development life cycle.\n\nSecurity and privacy documentation requirements address all stages of the system development life cycle. Documentation provides user and administrator guidance for the implementation and operation of controls. The level of detail required in such documentation is based on the security categorization or classification level of the system and the degree to which organizations depend on the capabilities, functions, or mechanisms to meet risk response expectations. Requirements can include mandated configuration settings that specify allowed functions, ports, protocols, and services. Acceptance criteria for systems, system components, and system services are defined in the same manner as the criteria for any organizational acquisition or procurement.\n\nOrganizations can determine other requirements that support security and operations, to include responsibilities for the organization and developer, and notification and timing requirements for support, maintenance and updates.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36],{"slug":21,"title":22,"published_at":23},"hard-coded-credentials-in-eseecloud-ip-cameras-leave-users-exposed","Hard-Coded Credentials in EseeCloud IP Cameras Leave Users Exposed","2026-10-15T18:21:38.566+00:00",{"slug":25,"title":26,"published_at":27},"fake-cloudflare-pages-trick-users-into-installing-lunexstealer-via-compromised-sites","Fake Cloudflare Pages Trick Users Into Installing LunexStealer via Compromised Sites","2026-10-07T08:20:36.6+00:00",{"slug":29,"title":30,"published_at":31},"proto6-vulnerabilities-expose-critical-supply-chain-security-gaps","Proto6 Vulnerabilities Expose Critical Supply Chain Security Gaps","2026-06-10T06:20:16.605+00:00",{"slug":33,"title":34,"published_at":35},"insecure-iot-devices-create-shadow-network-vulnerabilities","Insecure IoT Devices Create Shadow Network Vulnerabilities","2026-04-23T02:09:42.864+00:00",{"slug":37,"title":38,"published_at":39},"critical-design-flaw-in-ai-protocol-enables-supply-chain-attacks","Critical Design Flaw in AI Protocol Enables Supply Chain Attacks","2026-04-15T14:09:56.865+00:00",[41,46,51,55,59,64],{"slug":42,"name":43,"problem":44,"stories":45},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",3,{"slug":47,"name":48,"problem":49,"stories":50},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",2,{"slug":52,"name":53,"problem":54,"stories":50},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":56,"name":57,"problem":58,"stories":50},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",{"slug":60,"name":61,"problem":62,"stories":63},"patch-management","Automated patch management","Known holes get closed in days, not months.",1,{"slug":65,"name":66,"problem":67,"stories":63},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[69,74,78,82,87,92,96,100],{"family":70,"item":71,"code":72,"title":73,"together":45},"cis","2","Control 2","Inventory and Control of Software Assets",{"family":70,"item":75,"code":76,"title":77,"together":50},"7","Control 7","Continuous Vulnerability Management",{"family":70,"item":79,"code":80,"title":81,"together":50},"1","Control 1","Inventory and Control of Enterprise Assets",{"family":83,"item":84,"code":85,"title":86,"together":50},"gdpr","32","Article 32","Security of processing",{"family":88,"item":89,"code":90,"title":91,"together":50},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",{"family":70,"item":93,"code":94,"title":95,"together":63},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":70,"item":97,"code":98,"title":99,"together":63},"12","Control 12","Network Infrastructure Management",{"family":70,"item":101,"code":102,"title":103,"together":63},"18","Control 18","Penetration Testing"]