ComplianceNIST 800-53 control

NIST-SA-9 External System Services

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
SA System and Services Acquisition
Control
SA-9
ATT&CK techniques mitigated
6

Control statement

a. Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: [Assignment: controls]; b. Define and document organizational oversight and user roles and responsibilities with regard to external system services; and c. Employ the following processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis: [Assignment: processes, methods, and techniques].

Discussion

External system services are provided by an external provider, and the organization has no direct control over the implementation of the required controls or the assessment of control effectiveness. Organizations establish relationships with external service providers in a variety of ways, including through business partnerships, contracts, interagency agreements, lines of business arrangements, licensing agreements, joint ventures, and supply chain exchanges. The responsibility for managing risks from the use of external system services remains with authorizing officials. For services external to organizations, a chain of trust requires that organizations establish and retain a certain level of confidence that each provider in the consumer-provider relationship provides adequate protection for the services rendered. The extent and nature of this chain of trust vary based on relationships between organizations and the external providers. Organizations document the basis for the trust relationships so that the relationships can be monitored. External system services documentation includes government, service providers, end user security roles and responsibilities, and service-level agreements. Service-level agreements define the expectations of performance for implemented controls, describe measurable outcomes, and identify remedies and response requirements for identified instances of noncompliance.

ATT&CK mappings (CTID)

• T1041 Exfiltration Over C2 Channel • T1048 Exfiltration Over Alternative Protocol • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol • T1072 Software Deployment Tools • T1567 Exfiltration Over Web Service

Related

Mitigates · MITRE ATT&CK (6)

  • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1567 Exfiltration Over Web Service technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1048 Exfiltration Over Alternative Protocol technique
  • T1072 Software Deployment Tools technique

Related control · Compliance (12)

  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-CA-3 Information Exchange NIST 800-53 control
  • NIST-CP-2 Contingency Plan NIST 800-53 control
  • NIST-IR-4 Incident Handling NIST 800-53 control
  • NIST-IR-7 Incident Response Assistance NIST 800-53 control
  • NIST-PL-10 Baseline Selection NIST 800-53 control
  • NIST-PL-11 Baseline Tailoring NIST 800-53 control
  • NIST-PS-7 External Personnel Security NIST 800-53 control
  • NIST-SA-2 Allocation of Resources NIST 800-53 control
  • NIST-SA-4 Acquisition Process NIST 800-53 control
  • NIST-SR-3 Supply Chain Controls and Processes NIST 800-53 control
  • NIST-SR-5 Acquisition Strategies, Tools, and Methods NIST 800-53 control

Referenced by Compliance · enhancement of (8)

  • NIST-SA-9(1) Risk Assessments and Organizational Approvals NIST 800-53 enhancement
  • NIST-SA-9(2) Identification of Functions, Ports, Protocols, and Services NIST 800-53 enhancement
  • NIST-SA-9(3) Establish and Maintain Trust Relationship with Providers NIST 800-53 enhancement
  • NIST-SA-9(4) Consistent Interests of Consumers and Providers NIST 800-53 enhancement
  • NIST-SA-9(5) Processing, Storage, and Service Location NIST 800-53 enhancement
  • NIST-SA-9(6) Organization-controlled Cryptographic Keys NIST 800-53 enhancement
  • NIST-SA-9(7) Organization-controlled Integrity Checking NIST 800-53 enhancement
  • NIST-SA-9(8) Processing and Storage Location — U.S. Jurisdiction NIST 800-53 enhancement

Referenced by Compliance · has member (1)

  • NIST-SA System and Services Acquisition NIST 800-53 family

Referenced by Compliance · related control (21)

  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-AC-3(9) Controlled Release NIST 800-53 enhancement
  • NIST-CA-3 Information Exchange NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CP-2(7) Coordinate with External Service Providers NIST 800-53 enhancement
  • NIST-IR-4(10) Supply Chain Coordination NIST 800-53 enhancement
  • NIST-IR-7 Incident Response Assistance NIST 800-53 control
  • NIST-PM-31 Continuous Monitoring Strategy NIST 800-53 control
  • NIST-PS-7 External Personnel Security NIST 800-53 control
  • NIST-RA-3 Risk Assessment NIST 800-53 control
  • NIST-SA-2 Allocation of Resources NIST 800-53 control
  • NIST-SA-24 Design For Cyber Resiliency NIST 800-53 control
  • NIST-SA-4(9) Functions, Ports, Protocols, and Services in Use NIST 800-53 enhancement
  • NIST-SA-5 System Documentation NIST 800-53 control
  • NIST-SC-12 Cryptographic Key Establishment and Management NIST 800-53 control
  • NIST-SC-13 Cryptographic Protection NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control
  • NIST-SR-3 Supply Chain Controls and Processes NIST 800-53 control
  • NIST-SR-5 Acquisition Strategies, Tools, and Methods NIST 800-53 control