# SA-02 Allocation of Resources

NIST SP 800-53 control. Family: SA System and Services Acquisition. Function: preventative. Baselines: low, moderate, high, privacy. Mapping licence: CC BY-SA 4.0.

Statement: a. Determine the high-level information security and privacy requirements for the system or system service in mission and business process planning; b. Determine, document, and allocate the resources required to protect the system or system service as part of the organizational capital planning and investment control process; and c. Establish a discrete line item for information security and privacy in organizational programming and budgeting documentation.
Guidance: Resource allocation for information security and privacy includes funding for system and services acquisition, sustainment, and supply chain-related risks throughout the system development life cycle.

## Patterns that use it (4)
- Important (1): SP-018 Information Security Management System
- Standard (3): SP-001 Client Module; SP-002 Server Module; SP-011 Cloud Computing Pattern

## Clauses by framework (27 frameworks)
- iso_27001_2022: 7.1. OSA's own, not in NIST's crosswalk: 7.1
- nist_csf_2: GV.RR-03. OSA's own, not in NIST's crosswalk: GV.RR-03
- soc2_tsc: CC1.4, CC4.1
- iso_42001_2023: A.4.5
- anssi: Hygiene.36, SecNumCloud.15.1
- osfi_b13: B-13.1.2
- finma_circular: IV.A(23), IV.A(24), IV.A(25)
- gdpr: Art.25(1), Art.32(1)
- dora: Art.6(1)
- rbi_csf: ITGRCA.11
- fisc: FISC.T1
- hkma_tme1: TME1.2.2, TME1.5.3
- dnb_good_practice: DNB.1.1
- cra: CRA.I.1
- cbb_tm: TM-5
- nca_ecc: 1-6
- qatar_nia: GV, SD
- uae_ia: T10
- bog_cisd: CISD-SDLC
- bom_ctrm: 1.3, 3.7
- cpmi_pfmi: PFMI.P15
- eba_ict: 3.2.2, 3.6.1
- ffiec_is: I.C
- hitrust_csf: 10.a
- lloyds_ms: MS8.1
- solvency_ii: EIOPA-ICT-4.1
- mica: Art.34(5), Art.35(1), Art.41(1), Art.54(1), Art.62(1)
OSA's mapping for iso_27001_2022 and nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/SA-02
- Clauses only: /api/v1/controls/SA-02?fields=mappings
- Page for people: /controls/sa-02/