SA-9—External System Services

Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: ⚙organization-defined controls;

Define and document organizational oversight and user roles and responsibilities with regard to external system services; and

Employ the following processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis: ⚙organization-defined processes, methods, and techniques.