OSCAL Parameters within SA-9.1: Risk Assessments and Organizational Approvals
personnel or roles that approve the acquisition or outsourcing of dedicated information security services is/are defined;