03.16: System and Services Acquisition

Apply the following systems security engineering principles to the development or modification of the system and system components: [Assignment: organization-defined systems security engineering principles].

Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer. Provide options for risk mitigation or alternative sources for continued support for unsupported components that cannot be replaced.

Require the providers of external system services used for the processing, storage, or transmission of CUI to comply with the following security requirements: [Assignment: organization-defined security requirements]. Define and document user roles and responsibilities with regard to external system services, including shared responsibilities with external service providers. Implement processes, methods, and techniques to monitor security…