System and Services Acquisition (SA)

The System and Services Acquisition (SA) family defines security requirements for procuring, developing, and integrating external information systems and services. It ensures that acquisition processes incorporate risk assessments, contractual security clauses, and ongoing monitoring to protect federal data throughout the system lifecycle.