SA-9(1) Risk Assessments and Organizational Approvals
Control enhancement of SA-9 External System Services
Control
Conduct an organizational assessment of risk prior to the acquisition or outsourcing of information security services; and
Verify that the acquisition or outsourcing of dedicated information security services is approved by [Assignment: personnel or roles].
Discussion
Information security services include the operation of security devices, such as firewalls or key management services as well as incident monitoring, analysis, and response. Risks assessed can include system, mission or business, security, privacy, or supply chain risks.
Related controls
Need SA-9(1) implemented and evidenced?
We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.
Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.