Control Objectives: Acquisition or sale of facilities, technology, and services

Acquisition or sale of facilities, technology, and services

Allocate sufficient resources to protect Information Systems during capital planning.

Approve the risk assessment report of operational risks as a part of the acquisition feasibility study.

Conduct a risk assessment to determine operational risks as a part of the acquisition feasibility study.

Conduct an acquisition feasibility study prior to acquiring Information Technology assets.

Establish and maintain a product and services acquisition program.

Establish and maintain a product and services acquisition strategy.

Establish and maintain a software product acquisition methodology.

Establish and maintain facilities, assets, and services acceptance procedures.

Establish and maintain third party Software Maintenance Agreements.

Establish test environments separate from the production environment to support integration testing before product acquisition.

Identify and consider alternatives to meeting the security requirements when acquiring Information Technology assets.

Include required service levels in system acquisition contracts.

Include security requirements in system acquisition contracts.

Obtain system documentation before acquiring products and services.

Plan for acquiring facilities, technology, or services.

Require the Information System developer to create a Security Testing and Evaluation plan, implement the test, and provide the test results for all newly acquired Information Technology assets.

Require the Information System developer to have a Configuration Management plan for all newly acquired information technology assets.

Store source code documentation in escrow by an independent third party.