External System Services SA-9

System and Services Acquisition · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds SA-9 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, System and Services Acquisition family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

SA-9 (External System Services) is about the outside services your system leans on — a cloud host, a package mirror, an email relay, a managed database — and making sure whoever runs them meets your security and privacy requirements. You define who oversees each relationship, what the provider must do, and how you keep checking that they actually do it. It sits in the Low baseline because almost every system depends on at least one external service.

What good looks like

Keep an inventory of every external service the server depends on — hosting provider, package mirrors, NTP (Network Time Protocol) source, DNS (Domain Name System) resolver, and any API (Application Programming Interface) it calls.
For each one, record who the provider is, what it does for you, and the security requirements it must meet — encryption in transit, uptime, and breach notification.
Name a person who owns the relationship, so oversight and responsibilities are written down, not assumed.
Monitor that each provider keeps its commitments — check its status page, security bulletins, or attestation reports on a schedule.
Prefer providers that can show their controls — a SOC 2 (System and Organization Controls) report or similar — over ones that only claim them.

Framework mapping

NIST CSF 2.0 — GV.SC-07 — Risks posed by suppliers and their products and services are identified, assessed, and monitored over the relationship
CIS Controls v8 — Control 15 — Service Provider Management

How to move it toward Implemented

List the server's external dependencies — read /etc/apt/sources.list (or /etc/yum.repos.d/), /etc/resolv.conf, and timedatectl show-timesync for the time source — and save the list.
Write a short external-services register: each provider, what it supplies, the requirement it must meet, and who reviews it (for example, quarterly).
Confirm the connections are protected — verify package sources use https:// mirrors and signed repositories — and note which providers publish a security or compliance report.
Attach that register as hardening evidence on the asset, naming SA-9 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.