SA-4.5: System, Component, and Service Configurations

the developer of the system, system component, or system service is required to deliver the system, component, or service with security configurations implemented;

the configurations are used as the default for any subsequent system, component, or service reinstallation or upgrade.

System and services acquisition policy

procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process

solicitation documents

acquisition documentation

acquisition contracts for the system, system component, or system service

security configurations to be implemented by the developer of the system, system component, or system service

service level agreements

system security plan

other relevant documents or records

Organizational personnel with acquisition/contracting responsibilities

organizational personnel with the responsibility to determine system security requirements

system developers or service provider

organizational personnel with information security responsibilities

Mechanisms used to verify that the configuration of the system, component, or service is delivered as specified