FedRAMP Moderate
SA - System and Services Acquisition

FedRAMP Moderate SA-9(5): External System Services | Processing, Storage, and Service Location. Restrict the location of [Selection (one or more): information processing; information or data; system services] to [Assignment: organization-defined locations] based on [Assignment: organization-defined requirements or

External System Services | Processing, Storage, and Service Location. Restrict the location of [Selection (one or more): information processing; information or data; system services] to [Assignment: organization-defined locations] based on [Assignment: organization-defined requirements or

What else in your programme already covers this

This control maps to 28 controls across 16 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27001:2022 · 4 controls

  • 5.20 Addressing information security within supplier agreements
  • 5.21 Managing information security in the ICT supply chain
  • 5.23 Information security for use of cloud services
  • 5.31 Legal, statutory, regulatory and contractual requirements

ISO 27002:2022 · 4 controls

  • 5.20 Addressing information security within supplier agreements
  • 5.21 Managing information security in the ICT supply chain
  • 5.23 Information security for use of cloud services
  • 5.31 Legal, statutory, regulatory and contractual requirements

SOC 2 · 4 controls

  • SOC2-C1.1 Confidential information is identified and protected during receipt, processing, storage
  • SOC2-CC6.4 Restricts physical access to facilities and protected information assets (for example, data center facilities, back-up media storage, and other sensitive locations) to authorized personnel to meet the entity's objectives
  • SOC2-P6.4 Obtains privacy commitments from vendors and other third parties who have access to personal information to meet the entity's objectives related to privacy. The entity assesses those parties' compliance on a periodic and as-needed
  • SOC2-P6.5 Obtains commitments from vendors and other third parties with access to personal information to notify the entity in the event of actual or suspected unauthorized disclosures of personal information. Such notifications are reported to

NIST SP 800-53 Rev 5 · 3 controls

  • NIST800-CM-12 Information Location. Identify and document the location of [organization-defined] and the specific system components on which the information is processed and stored; Identify and document the users who have access to the system and
  • NIST800-PE-23 Facility Location. Plan the location or site of the facility where the system resides considering physical and environmental hazards; and For existing facilities, consider the physical and environmental hazards in the organizational risk management
  • NIST800-SA-9 External system services

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

APPI · 1 control

  • APPI-A28 Provision to Third Parties in Foreign Countries

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-P59 APRA Notification of Service Agreements and Offshoring

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-PS-8 Privacy Safeguard 8 - Overseas disclosure of CDR data

Australia My Health Records Act 2012 · 1 control

  • MYHR-CUD-4 Records not held or taken outside Australia

Australian Privacy Principles (APPs) · 1 control

  • APP-8 APP 8 - Cross-border disclosure of personal information

C5 (Germany) · 1 control

  • C5-PSS-12 Locations of Data Processing and Storage

CIS Controls v8 · 1 control

  • CIS-15.4 Ensure Service Provider Contracts Include Security Requirements

GDPR · 1 control

ISO 27701:2019 · 1 control

  • 7.5.2 Countries and international organizations to which PII can be transferred

NIST SP 800-161 Rev 1 · 1 control

PCI DSS 4.0 · 1 control

  • 12.5.2 PCI DSS scope documented and confirmed annually

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in SA - System and Services Acquisition

You are reading one control. How much of FedRAMP Moderate have you already done?

FedRAMP Moderate SA-9(5) is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of FedRAMP Moderate your existing evidence covers. Hold ISO 27002:2022 and 182 of 323 FedRAMP Moderate controls already carry evidence.

If you hold ISO 27002:202256.3% covered · 141 gapsIf you hold PCI DSS 4.051.1% covered · 158 gapsIf you hold ISO 27001:202249.8% covered · 162 gapsIf you hold NIST SP 800-171 Rev 345.5% covered · 176 gapsIf you hold C5 (Germany)37.2% covered · 203 gapsIf you hold CMMC 2.035% covered · 210 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 348 were rejected on the ISO 27002:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 28 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll FedRAMP Moderate controls