SA-4: Acquisition Process

security functional requirements, descriptions, and criteria are included explicitly or by reference using sa-04_odp.01 in the acquisition contract for the system, system component, or system service;

privacy functional requirements, descriptions, and criteria are included explicitly or by reference using sa-04_odp.01 in the acquisition contract for the system, system component, or system service;

security assurance requirements, descriptions, and criteria are included explicitly or by reference using sa-04_odp.01 in the acquisition contract for the system, system component, or system service;

privacy assurance requirements, descriptions, and criteria are included explicitly or by reference using sa-04_odp.01 in the acquisition contract for the system, system component, or system service;

controls needed to satisfy the security requirements, descriptions, and criteria are included explicitly or by reference using sa-04_odp.01 in the acquisition contract for the system, system component, or system service;

controls needed to satisfy the privacy requirements, descriptions, and criteria are included explicitly or by reference using sa-04_odp.01 in the acquisition contract for the system, system component, or system service;

security documentation requirements, descriptions, and criteria are included explicitly or by reference using sa-04_odp.01 in the acquisition contract for the system, system component, or system service;

privacy documentation requirements, descriptions, and criteria are included explicitly or by reference using sa-04_odp.01 in the acquisition contract for the system, system component, or system service;

requirements for protecting security documentation, descriptions, and criteria are included explicitly or by reference using sa-04_odp.01 in the acquisition contract for the system, system component, or system service;

requirements for protecting privacy documentation, descriptions, and criteria are included explicitly or by reference using sa-04_odp.01 in the acquisition contract for the system, system component, or system service;

the allocation of responsibility or identification of parties responsible for information security requirements, descriptions, and criteria are included explicitly or by reference using sa-04_odp.01 in the acquisition contract for the system, system component, or system service;

the allocation of responsibility or identification of parties responsible for privacy requirements, descriptions, and criteria are included explicitly or by reference using sa-04_odp.01 ;

the allocation of responsibility or identification of parties responsible for supply chain risk management requirements, descriptions, and criteria are included explicitly or by reference using sa-04_odp.01 ;