SA-4(7): Niap-Approved Protection Profiles

Control Family:

System And Services Acquisition

Parent Control:

SA-4: Acquisition Process

Priority:

CSF v1.1 References:

Baselines:

(Not part of any baseline)

Next Version:

Control Statement

The organization:

  1. Limits the use of commercially provided information assurance (IA) and IA-enabled information technology products to those products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists; and
  2. Requires, if no NIAP-approved Protection Profile exists for a specific technology type but a commercially provided information technology product relies on cryptographic functionality to enforce its security policy, that the cryptographic module is FIPS-validated.