NIST SP 800-53 Rev 5 MODERATE

SA System and Services Acquisition

NIST SP 800-53 Rev 5 MODERATE SA-9: External System Services

Require providers of external system services to comply with security/privacy requirements; document oversight roles.

Other controls in SA System and Services Acquisition

SA-1 Policy and Procedures
SA-10 Developer Configuration Management
SA-11 Developer Testing and Evaluation
SA-15 Development Process, Standards, and Tools. a. Require the developer of the system, system component, or system service to follow a documented development process that: 1. Explicitly addresses security and privacy requirements; 2. Identifies the
SA-2 Allocation of Resources
SA-22 Unsupported System Components. a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for continued support
SA-3 System Development Life Cycle
SA-4 Acquisition Process

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All NIST SP 800-53 Rev 5 MODERATE controls