Include the following requirements, descriptions, and criteria, explicitly or by reference, using one or more: standardized contract language; ... in the acquisition contract for the system, system component, or system service: Security and privacy functional requirements; Strength of mechanism requirements; Security and privacy assurance requirements; Controls needed to satisfy the security and privacy requirements. Security and privacy documentation requirements; Requirements for protecting security and privacy documentation; Description of the system development environment and environment in which the system is intended to operate; Allocation of responsibility or identification of parties responsible for information security, privacy, and supply chain risk management; and Acceptance criteria.
Security and privacy functional requirements are typically derived from the high-level security and privacy requirements described in SA-2 . The derived requirements include security and privacy capabilities, functions, and mechanisms. Strength requirements associated with such capabilities, functions, and mechanisms include degree of correctness, completeness, resistance to tampering or bypass, and resistance to direct attack. Assurance requirements include development processes, procedures, and methodologies as well as the evidence from development and assessment activities that provide grounds for confidence that the required functionality is implemented and possesses the required strength of mechanism. SP 800-160-1 describes the process of requirements engineering as part of the system development life cycle.
Controls can be viewed as descriptions of the safeguards and protection capabilities appropriate for achieving the particular security and privacy objectives of the organization and for reflecting the security and privacy requirements of stakeholders. Controls are selected and implemented in order to satisfy system requirements and include developer and organizational responsibilities. Controls can include technical, administrative, and physical aspects. In some cases, the selection and implementation of a control may necessitate additional specification by the organization in the form of derived requirements or instantiated control parameter values. The derived requirements and control parameter values may be necessary to provide the appropriate level of implementation detail for controls within the system development life cycle.
Security and privacy documentation requirements address all stages of the system development life cycle. Documentation provides user and administrator guidance for the implementation and operation of controls. The level of detail required in such documentation is based on the security categorization or classification level of the system and the degree to which organizations depend on the capabilities, functions, or mechanisms to meet risk response expectations. Requirements can include mandated configuration settings that specify allowed functions, ports, protocols, and services. Acceptance criteria for systems, system components, and system services are defined in the same manner as the criteria for any organizational acquisition or procurement.
Organizations can determine other requirements that support security and operations, to include responsibilities for the organization and developer, and notification and timing requirements for support, maintenance and updates.
security functional requirements, descriptions, and criteria are included explicitly or by reference using one or more: standardized contract language; ... in the acquisition contract for the system, system component, or system service; privacy functional requirements, descriptions, and criteria are included explicitly or by reference using one or more: standardized contract language; ... in the acquisition contract for the system, system component, or system service; strength of mechanism requirements, descriptions, and criteria are included explicitly or by reference using one or more: standardized contract language; ... in the acquisition contract for the system, system component, or system service; security assurance requirements, descriptions, and criteria are included explicitly or by reference using one or more: standardized contract language; ... in the acquisition contract for the system, system component, or system service; privacy assurance requirements, descriptions, and criteria are included explicitly or by reference using one or more: standardized contract language; ... in the acquisition contract for the system, system component, or system service; controls needed to satisfy the security requirements, descriptions, and criteria are included explicitly or by reference using one or more: standardized contract language; ... in the acquisition contract for the system, system component, or system service; controls needed to satisfy the privacy requirements, descriptions, and criteria are included explicitly or by reference using one or more: standardized contract language; ... in the acquisition contract for the system, system component, or system service; security documentation requirements, descriptions, and criteria are included explicitly or by reference using one or more: standardized contract language; ... in the acquisition contract for the system, system component, or system service; privacy documentation requirements, descriptions, and criteria are included explicitly or by reference using one or more: standardized contract language; ... in the acquisition contract for the system, system component, or system service; requirements for protecting security documentation, descriptions, and criteria are included explicitly or by reference using one or more: standardized contract language; ... in the acquisition contract for the system, system component, or system service; requirements for protecting privacy documentation, descriptions, and criteria are included explicitly or by reference using one or more: standardized contract language; ... in the acquisition contract for the system, system component, or system service; the description of the system development environment and environment in which the system is intended to operate, requirements, and criteria are included explicitly or by reference using one or more: standardized contract language; ... in the acquisition contract for the system, system component, or system service; the allocation of responsibility or identification of parties responsible for information security requirements, descriptions, and criteria are included explicitly or by reference using one or more: standardized contract language; ... in the acquisition contract for the system, system component, or system service; the allocation of responsibility or identification of parties responsible for privacy requirements, descriptions, and criteria are included explicitly or by reference using one or more: standardized contract language; ...; the allocation of responsibility or identification of parties responsible for supply chain risk management requirements, descriptions, and criteria are included explicitly or by reference using one or more: standardized contract language; ...; acceptance criteria requirements and descriptions are included explicitly or by reference using one or more: standardized contract language; ... in the acquisition contract for the system, system component, or system service.