SA-4.1: Functional Properties of Controls

System and services acquisition policy

system and services acquisition procedures

procedures addressing the integration of security and privacy requirements, descriptions, and criteria into the acquisition process

solicitation documents

acquisition documentation

acquisition contracts for the system, system component, or system services

system security plan

privacy plan

other relevant documents or records

Organizational personnel with acquisition/contracting responsibilities

organizational personnel with information security and privacy responsibilities

system developers

Organizational processes for determining system security functional requirements

organizational processes for developing acquisition contracts

mechanisms supporting and/or implementing acquisitions and the inclusion of security and privacy requirements in contracts