SA-9(2)—External System Services | Identification of Functions, Ports, Protocols, and Services

IL4 Mod

IL4 High

IL5

IL6

>Control Description

Require providers of the following external system services to identify the functions, ports, protocols, and other services required for the use of such services: ⚙organization-defined external system services.

>DoD Impact Level Requirements

FedRAMP Parameter Values

SA-9 (2) [all external systems where Federal information is processed or stored]

>Discussion

Information from external service providers regarding the specific functions, ports, protocols, and services used in the provision of such services can be useful when the need arises to understand the trade-offs involved in restricting certain functions and services or blocking certain ports and protocols.

>Programmatic Queries

Beta

Related Services

AWS Service Catalog

AWS Systems Manager

Amazon API Gateway

CLI Commands

Create Service Catalog product with service specifications

aws servicecatalog create-product --name 'Service with Port/Protocol Specs' --product-type CLOUD_FORMATION_TEMPLATE --provisioning-artifact-parameters file://service-specs.json

Create Parameter Store for service specifications

aws ssm put-parameter --name /services/external-service --value file://service-config.json --type String

Document API functions in API Gateway

aws apigateway create-rest-api --name external-service-api --description 'External service with documented functions'

Create resource and method documentation

aws apigateway create-resource --rest-api-id api-id --parent-id parent-resource-id --path-part 'service-function'

Open AWS Console Documentation

>Related Controls

CM-6

CM-7

>Assessment Interview Topics

Questions assessors commonly ask

Process & Governance:

•What acquisition policies and procedures address the requirements of SA-9(2)?
•How are security and privacy requirements integrated into the acquisition process?
•Who is responsible for ensuring that acquisitions comply with SA-9(2)?

Technical Implementation:

•How are security requirements defined and documented in acquisition contracts?
•What mechanisms ensure that acquired systems and services meet security requirements?
•How do you validate that vendors and service providers comply with specified security controls?

Evidence & Documentation:

•Can you provide examples of acquisition documentation that includes security requirements?
•What evidence demonstrates that acquired systems meet security specifications?
•Where is acquisition security documentation maintained throughout the system lifecycle?

Ask AI

Configure your API key to use AI features.