FedRAMP Controls / SA
SA-9(1) Risk Assessments and Organizational Approvals
Family SA
Baselines moderate
Mapped KSIs 0
Control statement
(a) Conduct an organizational assessment of risk prior to the acquisition or outsourcing of information security services; and
(b) Verify that the acquisition or outsourcing of dedicated information security services is approved by {{ insert: param, sa-09.01_odp }}. Parameter placeholders {{ insert: param, … }} reference FedRAMP-set values in the resolved profile. Full parameter map is
preserved in the catalog database.
No 20x Key Security Indicators map to this control in the current catalog version.