ComplianceNIST 800-53 enhancement
NIST-SA-4(7) NIAP-approved Protection Profiles
- Framework
- NIST SP 800-53 rev5 (5.2.0)
- Family
- SA System and Services Acquisition
- Control
- SA-4(7)
Control statement
(a) Limit the use of commercially provided information assurance and information assurance-enabled information technology products to those products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists; and
(b) Require, if no NIAP-approved Protection Profile exists for a specific technology type but a commercially provided information technology product relies on cryptographic functionality to enforce its security policy, that the cryptographic module is FIPS-validated or NSA-approved.
Discussion
See [NIAP CCEVS](#795aff72-3e6c-4b6b-a80a-b14d84b7f544) for additional information on NIAP. See [NIST CMVP](#1acdc775-aafb-4d11-9341-dc6a822e9d38) for additional information on FIPS-validated cryptographic modules.
Related
Enhancement of · Compliance (1)
- NIST-SA-4 Acquisition Process NIST 800-53 control
Related control · Compliance (3)
- NIST-IA-7 Cryptographic Module Authentication NIST 800-53 control
- NIST-SC-12 Cryptographic Key Establishment and Management NIST 800-53 control
- NIST-SC-13 Cryptographic Protection NIST 800-53 control