System and Services Acquisition Decision Worksheet

System and Services Acquisition Decision Worksheet template: Every decision the System and Services Acquisition family of NIST SP 800-53 Rev. 5 forces, with typical values and who decides, per baseline, as a spreadsheet.

Type	Program stage	Status	Template version	NIST basis
Decision worksheet	Operate	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

Every decision the System and Services Acquisition family asks your organization to make before its policy and procedures can be final: the family’s key questions, then each organization-defined parameter of every SA control in the baseline, with a typical value where the System and Services Acquisition Policy gives one. Download the spreadsheet, fill the “Your value” column with the people who decide, and carry the values into the policy’s highlighted fields.

Typical values are starting points, not recommendations for every system. “Who decides” defaults to the role accountable for the family policy; many organizations delegate system-level values to the system owner.

Downloads

Variant	Spreadsheet
Low	CSV
Moderate	CSV
High	CSV
Privacy	CSV

Decisions (Moderate baseline)

40 decisions.

Decision	Control	Typical value	Who decides
Which system development life cycle do systems follow, and where in it are the security and privacy activities and approvals?	SA-3, SA-8, SA-15	One organization-wide life cycle with five phases (initiation, development or acquisition, implementation and assessment, operations and maintenance, and disposal), each with named security and privacy activities and a gate the system owner cannot pass without the security and privacy reviews.	Chief Information Officer, with the Chief Information Security Officer and the senior privacy official
Who maintains the standard security and privacy contract language, and who checks that each acquisition uses it?	SA-4, SA-4(1), SA-4(2), SA-4(9), SA-4(10)	The procurement office keeps standard clauses that the Chief Information Security Officer and the senior privacy official approve; the system owner adds system-specific requirements, and the security team reviews each solicitation for a system, component or service before it is issued.	Chief Information Security Officer, with the procurement office
Who reviews an external service before the organization uses it, and how is the provider’s compliance checked afterwards?	SA-9, SA-9(2)	The security team reviews each new external service and its shared responsibility matrix before contract award; the system owner reviews the provider’s independent attestation reports each year and the provider’s status reports as they arrive.	Chief Information Security Officer
What must developers of custom systems and components deliver as evidence, and who reviews it?	SA-10, SA-11, SA-15, SA-15(3)	Configuration management records, the developer’s test plan and results (including static analysis, component analysis and dynamic testing), the flaw tracking record and the development tool list, reviewed by the system owner and the security team before each release is accepted.	System owner, with the Chief Information Security Officer
What happens to a component when its vendor stops supporting it, and who can approve keeping it?	SA-22	The component is replaced before its end-of-support date; where that is not possible, the authorizing official may approve continued use for a set period, with extended support from an external provider, isolation and extra monitoring, recorded in the plan of action and milestones.	Authorizing official
Personnel or roles to whom the system and services acquisition policy is to be disseminated	SA-1	Everyone within its scope, through the policy library	Chief Information Security Officer
Personnel or roles to whom the system and services acquisition procedures are to be disseminated	SA-1	The people who carry them out, and the system owners	Chief Information Security Officer
Select one or more: organization-level; mission/business process-level; system-level	SA-1	Organization-level	Chief Information Security Officer
An official to manage the system and services acquisition policy and procedures	SA-1	Chief Information Security Officer	Chief Information Security Officer
The frequency at which the current system and services acquisition policy is reviewed and updated	SA-1	Annually	Chief Information Security Officer
Events that would require the current system and services acquisition policy to be reviewed and updated	SA-1	Assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines	Chief Information Security Officer
The frequency at which the current system and services acquisition procedures are reviewed and updated	SA-1	Annually	Chief Information Security Officer
Events that would require the system and services acquisition procedures to be reviewed and updated	SA-1	The same events as the policy, and changes to the systems, tools or services the procedures describe	Chief Information Security Officer
System development life cycle	SA-3	The organization’s documented system development life cycle, with security and privacy activities and a review gate in each phase: initiation, development or acquisition, implementation and assessment, operations and maintenance, and disposal	Chief Information Security Officer
Select one or more: standardized contract language; organization-defined contract language (see its row below)	SA-4	Standardized contract language that the procurement office maintains and the Chief Information Security Officer and senior privacy official approve, with system-specific requirements added for each acquisition	Chief Information Security Officer
Contract language	SA-4	See the selection above	Chief Information Security Officer
Select one or more: security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; organization-defined design and implementation information (see its row below)	SA-4(2)	Security-relevant external system interfaces and high-level design, and for High systems also low-level design	Chief Information Security Officer
Design and implementation information	SA-4(2)	See the selection above	Chief Information Security Officer
Level of detail	SA-4(2)	Enough detail to show, for each subsystem and interface, which controls it implements and how	Chief Information Security Officer
Actions to take when system, system component, or system service documentation is either unavailable or nonexistent	SA-5	Ask the manufacturer or supplier again and search its published material; where the documentation is essential to operating a control, write it in-house; and record any remaining gap as a risk in the risk register	Chief Information Security Officer
Personnel or roles to distribute system documentation to	SA-5	The system owner, the system security officer and the system administrators	Chief Information Security Officer
Systems security engineering principles	SA-8	The principles for trustworthy secure design in NIST SP 800-160 Vol. 1 Rev. 1, Appendix E, as the system’s security architecture selects them, including least privilege, least functionality, defense in depth, protective defaults and protective failure	Chief Information Security Officer
Privacy engineering principles	SA-8	The privacy engineering objectives of predictability, manageability and disassociability from NIST IR 8062, and minimization (SA-8(33))	Chief Information Security Officer
Controls to be employed by external system service providers	SA-9	The controls of the system’s baseline that the provider is responsible for, per the shared responsibility matrix, with evidence from an independent attestation	Chief Information Security Officer
Processes, methods, and techniques employed to monitor control compliance by external service providers	SA-9	Annual review of independent attestation reports, review of the provider’s continuous monitoring or status reports, and contract service reviews	Chief Information Security Officer
External system services that require the identification of functions, ports, protocols, and other services	SA-9(2)	All external system services that connect to the system	Chief Information Security Officer
Select one or more: design; development; implementation; operation; disposal	SA-10	Design, development, implementation and operation	Chief Information Security Officer
Configuration items under configuration management	SA-10	Design specifications, source code, build scripts and pipeline configuration, infrastructure and configuration as code, test scripts and results, and each released executable	Chief Information Security Officer
Personnel to whom security flaws and flaw resolutions within the system, component, or service are reported	SA-10	The system owner and the Chief Information Security Officer	Chief Information Security Officer
Select one or more: unit; integration; system; regression	SA-11	Unit, integration, system and regression	Chief Information Security Officer
Frequency at which to conduct the selected unit, integration, system or regression testing/evaluation	SA-11	With each build for automated tests, and before each release to production for system and regression testing	Chief Information Security Officer
Depth and coverage of the selected unit, integration, system or regression testing/evaluation	SA-11	Static analysis of all custom code, analysis of third-party and open-source components for known vulnerabilities, dynamic testing of every externally reachable interface, and a test for each security and privacy requirement	Chief Information Security Officer
Frequency at which to review the development process, standards, tools, tool options, and tool configurations	SA-15	At least annually, and before a new development tool or a major change to the development process is adopted	Chief Information Security Officer
Security requirements to be satisfied by the process, standards, tools, tool options, and tool configurations	SA-15	The security requirements in the acquisition contract (SA-4) and the organization’s secure software development practices	Chief Information Security Officer
Privacy requirements to be satisfied by the process, standards, tools, tool options, and tool configurations	SA-15	The privacy requirements recorded in the system’s privacy impact assessment	Chief Information Security Officer
Decision points in the system development life cycle	SA-15(3)	During design, before acquiring major components or services, and when the architecture changes significantly	Chief Information Security Officer
The breadth of criticality analysis	SA-15(3)	The components and functions that support the system’s critical functions, including third-party and open-source components	Chief Information Security Officer
The depth of criticality analysis	SA-15(3)	Down to the component and software module level for each critical function, naming the supplier of each critical component	Chief Information Security Officer
Select one or more: in-house support; organization-defined support from external providers (see its row below)	SA-22	Support from an external provider under contract, such as extended vendor support or a third-party support provider; in-house support only for an isolated component whose replacement is scheduled	Chief Information Security Officer
Support from external providers	SA-22	See the selection above	Chief Information Security Officer