System and Services Acquisition

Please Read the Following Important Information

The collection of documents you are viewing for the System and Services Acquisition (SA) family includes all NIST RMF policies, procedures, programs, and plans necessary for meeting the control requirements for SA-1 to SA-23 of NIST SP 800-53, Revision 5 for LOW, MOD, and HIGH impact levels. This methodology results in ‘complete control coverage’ for each respective control family.

These are the essential documents for the ‘System and Services Acquisition’ control family needed for complying with FISMA, FedRAMP, NISP eMASS, NIST 800-171, CMMC, Cloud Security CUI, ITAR, and much more.

NIST SP 800-53, Revision 5, is the guiding publication that establishes security and privacy controls for all U.S. federal agencies, and for which all the above referenced compliance frameworks are essentially built on. Please note that NIST SP 800-53, Revision 4 was withdrawn on 09.23.2021.