SA-2, Allocation of Resources, is short. It asks the organization to determine high level security and privacy requirements during mission and business planning, to determine, document and allocate the resources needed to protect the system as part of capital planning, and to establish a discrete line item for security and privacy in budgeting documents.
800-53 binds US federal systems, and others through contract. For everyone else it is a reference, and the budget line is an easy thing for a customer to ask about.
What it means in practice
The guidance says resources cover funding for acquisition, sustainment and supply chain related risks across the life cycle. The key words are discrete line item. If security spend is buried inside general IT, nobody can say whether it is enough.
Evidence to collect
- A budget document with a visible security and privacy line.
- Planning notes that tie requirements to the funding request.
- Approval records for security spend.
Common gaps
Funding the tool at purchase and nothing for the people and renewals that keep it useful. Also, a line item that exists but with no stated requirement behind it.
How to implement it
At planning time, write the security requirements for each system, estimate the cost across its life, and give it a named line in the budget. Review it at each renewal cycle.
A small worked example
A product team plans a new customer portal. At planning they list requirements: single sign on, audit logs, encryption at rest. Each gets a cost estimate for build and for three years of running. The security items go into the budget as their own rows. At renewal, the finance lead can see what was planned and what was spent without digging.
Quick check
What is the single most checkable part of SA-2?
The discrete line item for security and privacy in budgeting documentation.
