## Apply Risk-Based Management Concepts to the Supply Chain

(p.39-40)
For all acquisitions, establish minimum security requirements. These should be modeled from your existing security policy. The security requirements for new hardware, software, or services should always meet or exceed the security of your existing infrastructure. When working with an external service, be sure to review any service-level agreement (SLA) to ensure that security is a prescribed component of the contracted services. This could include customization of service-level requirements for your specific needs. 

When evaluating a third party for your security integration, consider the following processes:

- On-Site Assessment
- Document Exchange and Review (investigate the means by which datasets and documentation are exchanged, and the formal processes fro assessments and reviews)
- Process/Policy Review
- Third-Party Audit

Chapple, Mike; Stewart, James Michael; Gibson, Darril. (ISC)2 CISSP Certified Information Systems Security Professional Official Study Guide (p. 39). Wiley. Kindle Edition. 

Here are some excellent resources related to security integrated with acquisition: 

- Improving Cybersecurity and Resilience through Acquisition. Final Report of the Department of Defense and General Services Administration, published November 2013 (www.gsa.gov/portal/getMediaData?mediaId=185371) 
- NIST Special Publication 800-64 Revision 2: Security Considerations in the System Development Life Cycle (http://csrc.nist.gov/publications/nistpubs/800-64-Rev2/SP800-64-Revision2.pdf)
