NIST SP 800-161 Rev 1 161R1-SA-4: Acquisition Process

What else in your programme already covers this

This control maps to 44 controls across 21 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27701:2019 · 4 controls

6.11.1 Security requirements of information systems
6.12.1 Information security in supplier relationships
7.2.6 Contracts with PII processors
8.5.7 Engagement of a subcontractor to process PII

NIST SP 800-218 · 4 controls

SP800-218-PO.1.1 Define Security Requirements for Software Development
SP800-218-PO.1.3 Communicate Requirements to Third-Party Providers
SP800-218-PO.4.1 Criteria for Software Security
SP800-218-PW.4.4 Verify Acquired Components Meet Security Requirements

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 3 controls

ANSSI-HYG-01 Train Operational Teams in Information System Security
ANSSI-HYG-03 Control the Risks of Outsourced Information System Management
ANSSI-HYG-42 Prefer Products and Services Qualified by ANSSI

HIPAA Security Rule · 3 controls

164.308(b)(1) Business Associate Contracts and Other Arrangements (Standard)
164.308(b)(3) Written Contract or Other Arrangement
164.314(a)(1) Business Associate Contracts or Other Arrangements (Standard)

ISO 27001:2022 · 3 controls

5.20 Addressing information security within supplier agreements
8.26 Application security requirements
8.30 Outsourced development

ISO 27002:2022 · 3 controls

5.20 Addressing information security within supplier agreements
8.26 Application security requirements
8.30 Outsourced development

SOC 2 · 3 controls

SOC2-CC2.3 CC2.3 Communication with external parties about internal control (COSO principle 15)
SOC2-P6.4 P6.4 Privacy commitments from vendors and third parties
SOC2-P6.5 P6.5 Vendor commitments to report unauthorised disclosures

APEC Cross-Border Privacy Rules (CBPR) System · 2 controls

CBPR-PR-46 Mechanisms with processors to meet obligations
CBPR-PR-47 Processor agreement content

APRA CPS 230 Operational Risk Management · 2 controls

CPS230-43 Due Diligence Before Entering or Modifying a Material Arrangement
CPS230-50 Formal Agreement Content for Material Arrangements

CIS Controls v8 · 2 controls

CIS-15.4 Ensure Service Provider Contracts Include Security Requirements
CIS-16.11 Leverage Vetted Modules or Services for Application Security Components

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-STA-09 Primary Service and Contractual Agreement
CCM-STA-12 Supply Chain Service Agreement Compliance

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
NIST-CSF-GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties

NIST SP 800-53 Rev 5 · 2 controls

NIST800-SA-4 SA-4 Acquisition Process
NIST800-SR-5 SR-5 Acquisition Strategies, Tools, and Methods

PCI DSS 4.0 · 2 controls

12.8.2 12.8.2 TPSP contracts acknowledging account data responsibility
12.9.1 12.9.1 TPSP written acknowledgments to customers

C5 (Germany) · 1 control

C5-SSO-01 Policies and instructions for controlling and monitoring third parties

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

CFTC-SS-5 Systems Development and Quality Assurance Category

DORA · 1 control

DORA-Art.30 Key contractual provisions

FedRAMP High · 1 control

SA-4 Acquisition Process

NIST SP 800-171 Rev 3 · 1 control

03.17.02 Acquisition Strategies, Tools, and Methods

NIST SP 800-66 Rev 2 · 1 control

164.308(b)(1) Business Associate Contracts and Other Arrangements (Standard)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of NIST SP 800-161 Rev 1 have you already done?

NIST SP 800-161 Rev 1 161R1-SA-4 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-161 Rev 1 your existing evidence covers. Hold C5 (Germany) and 94 of 191 NIST SP 800-161 Rev 1 controls already carry evidence.

If you hold C5 (Germany)49.2% covered · 97 gaps If you hold NIST SP 800-171 Rev 338.2% covered · 118 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.137.2% covered · 120 gaps If you hold NIST SP 800-17221.5% covered · 150 gaps If you hold AWS Well-Architected Security Pillar20.9% covered · 151 gaps If you hold DORA17.3% covered · 158 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the C5 (Germany) pair alone.

See the released pairs, $299 each Browse the graph free