SA-09 External System Services
System and Services Acquisition
Description
a. Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: [Assignment: organization-defined controls]; b. Define and document organizational oversight and user roles and responsibilities with regard to external system services; and c. Employ the following processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis: [Assignment: organization-defined processes, methods, and techniques].
Supplemental Guidance
External system services are provided by an external provider, and the organization has no direct control over the implementation of the required controls or the assessment of control effectiveness. Organizations establish relationships with external service providers in a variety of ways, including through business partnerships, contracts, interagency agreements, lines of business arrangements, licensing agreements, joint ventures, and supply chain exchanges. The responsibility for managing risks from the use of external system services remains with authorizing officials. For services external to organizations, a chain of trust requires that organizations establish and retain a certain level of confidence that each provider in the consumer-provider relationship provides adequate protection for the services rendered. The extent and nature of this chain of trust vary based on relationships between organizations and the external providers. Organizations document the basis for the trust relationships so that the relationships can be monitored. External system services documentation includes government, service providers, end user security roles and responsibilities, and service-level agreements. Service-level agreements define the expectations of performance for implemented controls, describe measurable outcomes, and identify remedies and response requirements for identified instances of noncompliance.
Changes from Rev 4
Title changed from 'External Information System Services' Control text adds ‘privacy’ and removes references to federal laws, Executive Orders, directives, etc. and to 'government' Changes parameter text 'security controls' to 'controls' Discussion updated to clarify that external system services are provided by an external provider, and the organization has no direct control over the implementation of the required controls or the assessment of control effectiveness Incorporates external service provider elements of withdrawn App J control AR-03
Enhancements (8)
What NIST adds to this control. Select one to read its statement.
SA-09(01) Risk Assessments and Organizational Approvals
a. Conduct an organizational assessment of risk prior to the acquisition or outsourcing of information security services; and b. Verify that the acquisition or outsourcing of dedicated information security services is approved by [Assignment: organization-defined personnel or roles].
SA-09(02) Identification of Functions, Ports, Protocols, and Services ModerateHigh
Require providers of the following external system services to identify the functions, ports, protocols, and other services required for the use of such services: [Assignment: organization-defined external system services].
SA-09(03) Establish and Maintain Trust Relationship with Providers
Establish, document, and maintain trust relationships with external service providers based on the following requirements, properties, factors, or conditions: [Assignment: organization-defined security and privacy requirements, properties, factors, or conditions defining acceptable trust relationships].
SA-09(04) Consistent Interests of Consumers and Providers
Take the following actions to verify that the interests of [Assignment: organization-defined external service providers] are consistent with and reflect organizational interests: [Assignment: organization-defined actions].
SA-09(05) Processing, Storage, and Service Location
Restrict the location of [Selection (one or more): information processing; information or data; system services] to [Assignment: organization-defined locations] based on [Assignment: organization-defined requirements or conditions].
SA-09(06) Organization-controlled Cryptographic Keys
Maintain exclusive control of cryptographic keys for encrypted material stored or transmitted through an external system.
SA-09(07) Organization-controlled Integrity Checking
Provide the capability to check the integrity of information while it resides in the external system.
SA-09(08) Processing and Storage Location — U.S. Jurisdiction
Restrict the geographic location of information processing and data storage to facilities located within in the legal jurisdictional boundary of the United States.
Patterns that use this control (17)
Grouped by the emphasis each pattern gives it.
Critical (4)
Important (10)
- SP-028 Secure DevOps Pipeline Pattern
- SP-032 Modern Authentication
- SP-034 Cyber Resilience
- SP-037 Privileged User Management
- SP-038 Vulnerability Management and Patching
- SP-044 SaaS Identity Lifecycle Management
- SP-046 External Attack Surface Management
- SP-049 AI in Security Operations (draft)
- SP-052 Decentralised Identity & Verifiable Credentials (draft)
- SP-054 CBDC and Digital Currency Infrastructure (draft)
MITRE ATT&CK Techniques (6)
ATT&CK v16.1Techniques mitigated by this control, mapped via CTID.