03.16 System and Services Acquisition...

Phase 2 - A suggested method would be to include in your policy, a statement that mandates a thorough risk assessment of all software and services prior to acquisition. This assessment should evaluate potential supply chain risks, security vulnerabilities, and compliance gaps. We should also establish clear guidelines for vendor selection, including security requirements and contractual obligations. Furthermore, the policy should outline procedures for ongoing monitoring and evaluation of acquired systems and services to ensure they continue to meet our security standards and comply with NIST 800-171 controls.