Risk Assessments and Organizational Approvals
High Risk
Moderate
Medium Cost
SA-9(1) (Risk Assessments and Organizational Approvals) enhances base SA-9 within the NIST System and Services Acquisition family. Base SA-9 sets the foundational expectation; this enhancement adds specificity: Conduct an organizational assessment of risk prior to the acquisition or outsourcing of information security services; and Verify that the acquisition or outsourcing of dedicated information security services is approved by [organization-defined]. Covered entities and business associates apply it to system acquisition, SDLC, developer testing, supply chain, and engineering principles for EHR, interfaces, and clinical SaaS.
Control Objective
Implement Risk Assessments and Organizational Approvals so acquisition, development, and engineering safeguards operate consistently on systems handling ePHI, with measurable evidence for HIPAA and NIST assessments.
Implementation Guidance
- Map SA-9(1) to in-scope acquired/built systems (EHR, imaging, lab, pharmacy, billing, portals, interfaces, identity).\n2. Translate “Risk Assessments and Organizational Approvals” into contract clauses, SDLC gates, architecture patterns, or verification steps with named owners.\n3. Prefer enforceable pipeline and configuration controls over checklist-only assurances where feasible.\n4. Include BA/OEM obligations and evidence deliverables when vendors develop or host ePHI components.\n5. Integrate with change, release, and incident processes so clinical go-lives do not bypass the enhancement.\n6. Retain design packages, test results, SBOMs, and tickets as audit evidence.\n7. Re-validate after major version upgrades — vendors often reset secure defaults.\n8. Review exceptions quarterly; expire “temporary” acquisition waivers that leave ePHI exposed.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Best Practices
- Name an owner for SA-9(1) in the SSP / acquisition control matrix.\n- Put security and privacy requirements in RFPs and BA agreements before award.\n- Measure coverage: percent of ePHI systems where the enhancement’s gates actually run.\n- Keep a one-page evidence pack (design excerpt + test sample + last review) ready.\n- Map withdrawn SA-12 intent to SR-family controls when using Rev. 5 baselines.\n- Re-test after EHR and interface platform upgrades.
Common Gaps & Violations
- Policy cites SA-9(1) but builds/procurements of ePHI systems show no enforcement of risk assessments and organizational approvals.\n- Vendors self-attest without artifacts (tests, SBOMs, design docs).\n- Clinical systems and interfaces excluded “because the OEM manages security.”\n- Permanent acquisition waivers with no residual-risk acceptance.\n- Title left as placeholder (“Enhanced …”) with empty use cases.
Required Documentation
- Procedure/standard for Risk Assessments and Organizational Approvals (SA-9(1))\n- RFP/contract security exhibits and BA terms\n- SDLC gate definitions and sample evidence\n- Architecture or SBOM / integrity verification records as applicable\n- Exception register with owners and expiry
How to Test & Validate
- Sample a recent acquisition or release touching ePHI; verify risk assessments and organizational approvals evidence exists.\n2. Confirm a failed gate or finding actually blocked or delayed promotion.\n3. Interview vendor manager for BA deliverables tied to this enhancement.\n4. Check that clinical interfaces and portals are in scope — not only corporate IT apps.\n5. For SA-12 entries, verify mapping to active SR controls in the SSP.
Audit Considerations
Assessors look for operating proof of Risk Assessments and Organizational Approvals on acquired or developed systems with ePHI — contracts, pipeline evidence, design packages, and test artifacts — not only a NIST citation for SA-9(1).
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.308(a)(1)(ii)(B) Risk Management — acquisition and development choices reduce residual risk to ePHI.\n- 164.308(a)(8) Evaluation — technical and nontechnical evaluations include systems acquired or developed for ePHI.\n- 164.314(a) Business Associate Contracts — vendors developing or hosting ePHI systems must meet security requirements.\n- 164.312(a)–(e) Technical Safeguards — acquired systems must support access, audit, integrity, auth, and transmission controls.
Compliance Tips
- List SA-9(1) in the SSP with system inventory and BA references.\n- Prioritize EHR, identity, imaging, and external connections first.\n- Bundle evidence with HIPAA evaluation (§164.308(a)(8)) and BA oversight narratives.
References & Resources
- NIST SP 800-53 Rev. 5 — SA-9(1)\n- Related controls: SA-9, CA-6, RA-3, RA-8
Related Guidelines
Related controls that commonly accompany SA-9(1).
Need Help Implementing SA-9(1)?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.