03.16.03 External System Services

This policy outlines the organization's requirements for the use of external system services that process, store, or transmit Controlled Unclassified Information (CUI). It establishes a framework for selecting, evaluating, and managing the security risks associated with these services, ensuring compliance with applicable laws, regulations, and NIST 800-171 requirements.

• A.03.16.03.ODP[01]: security requirements to be satisfied by external system service providers are defined.
• A.03.16.03.a: the providers of external system services used for the processing, storage, or transmission of CUI comply with the following security requirements: <A.03.16.03.ODP[01]: security requirements>.
• A.03.16.03.b: user roles and responsibilities with regard to external system services, including shared responsibilities with external service providers, are defined and documented.
• A.03.16.03.c: processes, methods, and techniques to monitor security requirement compliance by external service providers on an ongoing basis are implemented.