System and Services Acquisition (SA) templates
Templates for the System and Services Acquisition (SA) family of controls in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 5, with the family policy and procedure first.
- System and Services Acquisition PolicyPOL-SA
In this policy, the CISO sets the Organization's requirements for system and services acquisition in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- System and Services Acquisition ProcedurePROC-SA
The people named in this procedure use it to carry out the SA control family policy (POL-SA). It covers every control in the system and services acquisition family.
- Large Language Model Procurement RequirementsPOL-LLM-001
- Software and Hardware Assurance PolicyPOL-SWHW-001
- Unmanned Aircraft Systems Security ProcedurePROC-UAS-001
A UAS carries sensors, storage, radios, and software, and it often connects to a vendor cloud. It is an information system in its own right. The CISO and the people named below use this procedure so that the Organization evaluates and authorizes a UAS like any other system before it commits money.
- End-of-Support Edge Device Inventory and Decommission PlanPLAN-EOS-001
Vendors no longer release security fixes for an end-of-support edge device, and attackers target boundary devices first. The CISO uses this plan to find these devices in the Organization, remove them, and keep them from coming back.