The organization: SA-1a.
Develops, documents, and disseminates to Assignment: organization-defined personnel or roles: SA-1a.1.
A system and services acquisition policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and SA-1a.2.
Procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls; and SA-1b.
Reviews and updates the current: SA-1b.1.
System and services acquisition policy Assignment: organization-defined frequency; and SA-1b.2.
System and services acquisition procedures Assignment: organization-defined frequency.