SA - System and Services Acquisition

The SA family addresses the planning, procurement, and management of information system components and services to ensure they meet security and privacy requirements. It guides organizations in establishing acquisition strategies, evaluating vendors, integrating security controls into contracts, and verifying that purchased hardware, software, and services align with approved risks and compliance objectives.