SA-1 Policy and Procedures opens the System and Services Acquisition family. That family covers what you buy and what you build. NIST 800-53 binds US federal systems, and others through contracts. For everyone else it is a reference for the documents a customer may request.
What it means in practice
The statement asks you to develop, document and disseminate a system and services acquisition policy covering purpose, scope, roles, responsibilities, management commitment, coordination and compliance, consistent with applicable law. You also need procedures to carry it out, a designated official to manage both, and reviews on a schedule you define and after defined events.
The guidance says security and privacy teams should write these together, and that organization level policy is generally preferable.
Evidence to collect
- The policy and procedures with owner, version and approval date.
- Proof of distribution.
- The designated official.
- Review records.
Common gaps
- Procurement has a process, but security is not part of it.
- Software development rules live in a wiki and are not tied to the policy.
- No review since the last major change in tooling.
How to implement it
Write one policy that covers both buying and building. Include security requirements in vendor selection, contract terms, development practice and change control. Link to your procedures, assign an owner and set an annual review.
Quick check
Does SA-1 cover open source we pull into our product?
It can. Acquisition includes components you bring in. Many teams cover them in the policy through approval and scanning rules.
