Citation Audit

Citation: SA-9a. – Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: [GovRAMP Assignment: Appropriate GovRAMP Security Controls Baseline (s) if State information is processed or stored within the external system];

Control: CC ID 359 – Include a provision in outsourcing contracts that requires supply chain members' security requirements comply with organizational security requirements.