Compliancemanzill.com
NIST 800-53 rev.5

NIST 800-53 rev.5/System and Services Acquisition/656 of 1011

SA-04 (12)Acquisition Process | Data Ownership

Control family: System and Services Acquisition

Control description

(a) Include organizational data ownership requirements in the acquisition contract; and

(b) Require all data to be removed from the contractor’s system and returned to the organization within [Assignment: organization-defined time frame].

How to implement

Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.