Internal Use

System and Services Acquisition Policy and Procedures

Dispel

Document Control

1. PURPOSE AND SCOPE

1.1 Purpose

The purpose of this policy and procedures document is to define how Dispel acquires systems and services, ensuring that security, privacy, and supply chain risks are addressed throughout the acquisition lifecycle.

1.2 Scope

This policy applies to:

• All acquisitions of systems and services that support Dispel operations, including cloud services, software, hardware, and managed services.
• Acquisitions related to Dispel’s FedRAMP systems (e.g., the Dispel Zero Trust Engine) as well as other systems within the information security program.
• All Covered Persons involved in evaluating, approving, and managing system and service acquisitions.

1.3 Regulatory and Framework Alignment

2. POLICY STATEMENTS

2.1 Management Commitment

Management Commitment Statement

Senior Management at Dispel is dedicated to the protection of our information assets, industrial control systems, and Protected Health Information (PHI). We assume full accountability for the effectiveness of our security program, ensuring it is integrated into all business processes and aligned with our strategic goals. To maintain compliance with ISO 27001, IEC 62443, HIPAA, and NIST 800-53, we formally commit to:

• Resource Provisioning: Providing the necessary financial, technical, and human resources to sustain a robust security posture.
• Risk-Based Governance: Approving security policies and overseeing a continuous risk management process that prioritizes both data privacy and operational safety.
• Operational Resilience: Supporting the security of industrial automation and control systems (IACS) to ensure safety and reliability.
• Continuous Oversight: Conducting regular management reviews to evaluate program performance, audit results, and opportunities for improvement.

2.2 Primary Policy Statement

Dispel SHALL ensure that system and service acquisitions include appropriate security and privacy requirements and that acquired systems and services are assessed and managed for risk.

2.3 Secondary Policy Statement

• Acquisition activities SHALL consider lifecycle costs, including security controls, monitoring, and decommissioning.
• External system services SHALL be governed by appropriate contracts and oversight.

3. REQUIREMENTS

3.1 Acquisition Governance

Objective: Establish governance for system and services acquisition.

Mandatory Activities:

1. The Policy Owner SHALL own this policy and associated procedures and ensure they are reviewed at least annually.
2. Acquisition roles and responsibilities (e.g., Procurement, Security, Legal, System Owners) SHALL be defined and communicated.
3. This policy and procedures SHALL be disseminated to Covered Persons involved in acquisition; review, acceptance, and acknowledgement SHALL be required initially and at least annually.

Required Outputs:

• Approved acquisition policy and procedures.
• Records of acknowledgements for relevant roles.

Security Controls: NIST SP 800-53 SA-1, SA-2.

3.2 Acquisition Requirements and Process

Objective: Ensure acquisitions reflect security and privacy requirements.

Mandatory Activities:

1. For each acquisition, Dispel SHALL define functional, security, and privacy requirements.
2. Requests for proposal (RFPs), contracts, or equivalent documents SHALL include relevant requirements and evaluation criteria.
3. Risk assessments SHALL be conducted for significant acquisitions, considering suppliers' control environments and C-SCRM concerns.

Required Outputs:

• Documented acquisition requirements.
• Acquisition risk assessments and decisions.

Security Controls: NIST SP 800-53 SA-4, SA-5.

3.3 External System Services and Developer Responsibilities

Objective: Manage risks related to external services and development activities.

Mandatory Activities:

1. External system services (e.g., cloud services, managed services) SHALL be governed by contracts that define security and privacy responsibilities.
2. For acquisition of development services or components, Dispel SHALL ensure developers follow secure development practices and provide appropriate documentation, testing, and training as applicable.
3. Criticality analyses MAY be performed to identify components or services requiring heightened scrutiny.

Required Outputs:

• Contracts and statements of work with security and privacy clauses.
• Documentation of developer security responsibilities and deliverables.

Security Controls: NIST SP 800-53 SA-9, SA-10, SA-11, SA-15, SA-16, SA-17, SA-21, SA-22.

4. ROLES AND RESPONSIBILITIES

4.1 Policy Owner

Responsibilities:

• Owns this System and Services Acquisition Policy and Procedures.
• Ensures integration with risk management, vendor management, and supply chain policies.
• Coordinates periodic reviews and updates.

4.2 Procurement / Acquisition Teams

Responsibilities:

• Coordinate acquisition activities and ensure requirements are captured.
• Maintain inventories of acquired systems and services.
• Work with Security, Legal, and System Owners throughout the acquisition lifecycle.

4.3 Security Officer

Responsibilities:

• Provide input on acquisition security requirements and evaluation criteria.
• Review risk assessments and supplier security posture for significant acquisitions.

4.4 System Owners

Responsibilities:

• Define system-specific requirements and constraints.
• Participate in evaluation and selection of systems and services.
• Ensure acquired systems and services are integrated in line with this policy.

5. PROCEDURES

5.1 Acquisition Lifecycle (High-Level)

6. MONITORING AND COMPLIANCE

6.1 Compliance Monitoring

Compliance with this policy SHALL be monitored through:

• Reviews of acquisition documentation, contracts, and risk assessments.
• Audits of external system services and their performance against requirements.
• Incident reviews related to acquired systems and services.

6.2 Metrics and Reporting

The following metrics SHALL be tracked and reported at least annually to the Policy Owner and senior management:

6.3 Non-Compliance Consequences

Failure to comply with this policy and procedures may result in:

• Increased exposure to risks from acquired systems and services.
• Revocation or restriction of access for Covered Persons who repeatedly fail to follow acquisition procedures.
• Disciplinary action for employees and contractors, consistent with Dispel HR policies and applicable law.

7. EXCEPTIONS AND WAIVERS

7.1 Exception Process

Exceptions to this policy SHALL:

1. Be submitted in writing by the requesting party.
2. Identify the specific policy or procedural requirements for which an exception is sought.
3. Include justification and business impact.
4. Describe compensating controls or mitigation measures.
5. Define exception duration and remediation plan.

7.2 Exception Approval Authority

8. DEFINITIONS

Acquisition: The process of procuring systems, services, or components to support Dispel operations.

External System Service: A service provided by an external provider that is integrated with or relied upon by Dispel systems.

9. REFERENCES

9.1 Internal References

• Risk Assessment Policy and Procedures.
• Vendor Management Policy.
• System Supply Chain Risk Management Policy and Procedures.

9.2 External References

• NIST SP 800-53, SA family.
• ISO/IEC 27001 and ISO/IEC 27036 series.

10. DOCUMENT HISTORY

11. APPROVAL SIGNATURES

APPENDICES

Appendix A: Supporting Acquisition Procedures

This appendix may include:

• Acquisition checklists and templates.
• Sample RFP and contract language.

Appendix B: Additional Guidance and Examples

This appendix may include:

• Example acquisition scenarios and lessons learned.
• References to industry best practices for system and services acquisition.