NIST SP 800-53 Rev 5 MODERATE SA-1: Policy and Procedures

Requires a system and services acquisition policy and supporting procedures to be developed, documented, disseminated, reviewed and updated on a defined cycle.

Other controls in SA System and Services Acquisition

SA-10 Developer Configuration Management
SA-11 Developer Testing and Evaluation
SA-15 Development Process, Standards, and Tools. a. Require the developer of the system, system component, or system service to follow a documented development process that: 1. Explicitly addresses security and privacy requirements; 2. Identifies the
SA-2 Allocation of Resources
SA-22 Unsupported System Components. a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for continued support
SA-3 System Development Life Cycle
SA-4 Acquisition Process
SA-5 System Documentation

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All NIST SP 800-53 Rev 5 MODERATE controls