Appearance
NIST 800-53 Vendor Risk Management Policy (SA/SR)
Document ID: PLCY-NIST-SA-001
Version: 1.0
Effective Date: December 30, 2025
Last Review: December 30, 2025
Owner: Hop And Haul Team
CONFIDENTIAL
This document is CONFIDENTIAL and for internal use only. Do not distribute outside the organization.
1. Purpose
This document defines Hop And Haul' implementation of the NIST 800-53 System and Services Acquisition (SA) and Supply Chain Risk Management (SR) families for FedRAMP Moderate authorization. It establishes requirements for managing third-party vendor risks, securing the supply chain, and ensuring that external services meet security requirements.
2. Scope
This policy applies to:
- All third-party vendors providing services to Hop And Haul
- All external system integrations
- All software dependencies and libraries
- All cloud service providers
- All contractors with system access
3. System and Services Acquisition Policy (SA-1)
3.1 Policy Statement
Hop And Haul implements vendor risk management that:
- Assesses security posture before vendor engagement
- Requires contractual security obligations
- Monitors vendor compliance continuously
- Manages supply chain risks
3.2 Responsibilities
| Role | Responsibilities |
|---|---|
| Security Team | Vendor security assessment, monitoring |
| Legal | Contract review, security clauses |
| Procurement | Vendor selection, contract management |
| Technical Teams | Integration security, API security |
4. Resource Allocation (SA-2)
4.1 Security in Planning
| Activity | Security Involvement |
|---|---|
| Vendor selection | Security assessment required |
| Contract negotiation | Security clauses required |
| Integration planning | Security architecture review |
| Budget planning | Security tools and assessments funded |
4.2 Security Budget Items
| Item | Purpose |
|---|---|
| Vendor assessments | Third-party security reviews |
| Security tools | Scanning, monitoring |
| Training | Secure development, awareness |
| Audits | Compliance verification |
5. System Development Life Cycle (SA-3)
5.1 SDLC Security Integration
| Phase | Security Activities |
|---|---|
| Requirements | Security requirements defined |
| Design | Threat modeling, security architecture |
| Development | Secure coding, SAST |
| Testing | Security testing, penetration testing |
| Deployment | Security verification, hardening |
| Maintenance | Vulnerability management, patching |
5.2 Security Checkpoints
| Checkpoint | Requirements |
|---|---|
| Design review | Security architecture approved |
| Code review | Security review completed |
| Pre-deployment | Security scan passed |
| Post-deployment | Security verification completed |
6. Acquisition Process (SA-4)
6.1 Security Requirements in Acquisitions
| Requirement | Application |
|---|---|
| Security questionnaire | All vendors with data access |
| SOC 2 report | Cloud services, data processors |
| FedRAMP authorization | Federal workloads |
| Penetration test results | High-risk integrations |
| Security certifications | As appropriate |
6.2 Vendor Assessment Criteria
| Category | Weight | Criteria |
|---|---|---|
| Security certifications | 25% | SOC 2, ISO 27001, FedRAMP |
| Security practices | 25% | Policies, procedures, training |
| Technical controls | 25% | Encryption, access controls, monitoring |
| Incident response | 15% | IR plan, breach history, notification |
| Compliance | 10% | Regulatory compliance, audits |
6.3 Assessment Levels
| Vendor Risk | Assessment Depth |
|---|---|
| Critical | Full assessment, on-site if needed |
| High | Detailed questionnaire, evidence review |
| Moderate | Standard questionnaire |
| Low | Basic due diligence |
7. System Documentation (SA-5)
7.1 Required Documentation
| Document | Content |
|---|---|
| System architecture | Components, data flows, integrations |
| Security architecture | Controls, boundaries, encryption |
| API documentation | Endpoints, authentication, data formats |
| Operations runbook | Procedures, contacts, escalation |
| Incident response | Vendor-specific procedures |
7.2 Documentation Maintenance
| Activity | Frequency |
|---|---|
| Architecture review | Annual or on significant change |
| Security documentation | Annual or on control changes |
| API documentation | With each API change |
| Runbook review | Quarterly |
8. Security Engineering Principles (SA-8)
8.1 Design Principles
| Principle | Implementation |
|---|---|
| Defense in depth | Multiple security layers |
| Least privilege | Minimal necessary access |
| Separation of duties | Role-based controls |
| Fail secure | Secure default on failure |
| Zero trust | Verify all access requests |
8.2 Architecture Standards
| Standard | Requirement |
|---|---|
| API security | OAuth 2.0/OIDC, TLS 1.3 |
| Data protection | Encryption at rest and in transit |
| Access control | RBAC, tenant isolation |
| Logging | Comprehensive audit trails |
9. External System Services (SA-9)
9.1 External Service Requirements
| Requirement | Description |
|---|---|
| Security agreement | Contractual security obligations |
| Data handling | Data protection, retention, deletion |
| Access controls | Authentication, authorization |
| Monitoring | Logging, alerting |
| Incident notification | Breach notification requirements |
9.2 Service Provider Monitoring
| Activity | Frequency |
|---|---|
| SOC 2 report review | Annual |
| Security questionnaire | Annual |
| Incident review | As needed |
| Access review | Quarterly |
10. Developer Security Testing (SA-11)
10.1 Testing Requirements
| Test Type | Timing | Coverage |
|---|---|---|
| SAST | Every commit | All code |
| DAST | Pre-release | All endpoints |
| SCA | Daily | All dependencies |
| Penetration testing | Annual | Full application |
10.2 Vulnerability Standards
| Severity | Action Required |
|---|---|
| Critical | Block release, immediate fix |
| High | Fix before release |
| Medium | Fix within 30 days |
| Low | Track and remediate |
11. Supply Chain Risk Management (SR)
11.1 Supply Chain Security Policy
| Control | Implementation |
|---|---|
| Vendor vetting | Security assessment before engagement |
| Component verification | Dependency scanning, checksums |
| Continuous monitoring | Vendor security updates, breaches |
| Contingency planning | Vendor alternatives identified |
11.2 Component Provenance
| Component Type | Verification |
|---|---|
| Open source | License review, security scanning |
| Commercial | Vendor assessment, contract review |
| Cloud services | FedRAMP or equivalent |
| Infrastructure | AWS FedRAMP High |
12. Current Vendor Risk Register
12.1 Critical/High Risk Vendors
| Vendor | Service | FedRAMP Status | Risk Level | Mitigation |
|---|---|---|---|---|
| AWS | Infrastructure | FedRAMP High | Low | Inherited controls |
| Cloudflare | Zero Trust, CDN, WAF | FedRAMP Moderate | Low | Inherited controls |
| Twilio | Voice/SMS relay | FedRAMP Moderate | Medium | Data minimization |
| Samsara | Fleet telematics | Not FedRAMP | High | Scoped integration |
12.2 Vendor-Specific Mitigations
AWS (FedRAMP High)
| Risk | Mitigation |
|---|---|
| Shared responsibility | Clear boundary documentation |
| Data residency | US-only regions configured |
| Access control | IAM policies, MFA required |
Cloudflare (FedRAMP Moderate)
| Risk | Mitigation |
|---|---|
| Traffic inspection | End-to-end encryption maintained |
| Configuration | Zero Trust policies documented |
| Access | SSO integration, audit logging |
Twilio (FedRAMP Moderate)
| Risk | Mitigation |
|---|---|
| Voice data | No call recording enabled |
| Message content | Minimal data in SMS |
| Integration security | API key rotation, least privilege |
Samsara (Not FedRAMP)
| Risk | Mitigation |
|---|---|
| Not FedRAMP authorized | Customer responsibility for federal workloads |
| API security | Scoped API keys, secrets management |
| Data exposure | Read-only integration, minimal data |
| Key compromise | Automatic rotation, anomaly detection |
13. API Integration Security
13.1 Integration Security Requirements
| Requirement | Implementation |
|---|---|
| Authentication | API keys or OAuth 2.0 |
| Encryption | TLS 1.3 minimum |
| Rate limiting | Per-integration limits |
| Logging | All API calls logged |
| Monitoring | Anomaly detection |
13.2 API Key Management
| Control | Implementation |
|---|---|
| Storage | AWS Secrets Manager |
| Rotation | Quarterly (automatic) |
| Scope | Least privilege |
| Monitoring | Usage tracking |
| Revocation | Immediate capability |
13.3 Samsara Integration Specifics
| Control | Requirement |
|---|---|
| Key storage | AWS Secrets Manager |
| Key scope | Read-only, specific vehicle tags |
| Envelope encryption | Per-tenant key wrapping |
| Rate limiting | Per-tenant API limits |
| Anomaly detection | Usage spike alerting |
| Kill switch | Automatic revocation on anomaly |
14. Contract Security Requirements
14.1 Required Contract Clauses
| Clause | Purpose |
|---|---|
| Data protection | Encryption, access controls |
| Breach notification | Timeline, content requirements |
| Audit rights | Right to assess vendor security |
| Subprocessor approval | Control over data sharing |
| Data deletion | Return or destruction requirements |
| Compliance | Regulatory compliance obligations |
14.2 Service Level Agreements
| SLA | Requirement |
|---|---|
| Availability | 99.9% or better |
| Incident response | 1 hour acknowledgment |
| Breach notification | 24-48 hours |
| Support | 24/7 for critical issues |
15. Vendor Monitoring and Review
15.1 Ongoing Monitoring
| Activity | Frequency | Owner |
|---|---|---|
| SOC 2 report review | Annual | Security |
| Security questionnaire | Annual | Security |
| FedRAMP status check | Quarterly | Security |
| Incident tracking | Continuous | Security |
| News/breach monitoring | Continuous | Security |
15.2 Review Triggers
| Trigger | Action |
|---|---|
| Vendor breach | Immediate assessment |
| SOC 2 findings | Risk reassessment |
| Service degradation | Performance review |
| Regulatory change | Compliance review |
| Contract renewal | Full reassessment |
16. Unsupported Components (SA-22)
16.1 End-of-Life Management
| Status | Action |
|---|---|
| End-of-life announced | Plan migration |
| 6 months to EOL | Migration in progress |
| EOL reached | Component replaced |
| Extended support | Document risk acceptance |
16.2 Dependency Management
| Activity | Frequency |
|---|---|
| Dependency audit | Monthly |
| EOL tracking | Quarterly |
| Update planning | Continuous |
| Security patches | Per SLA |
17. FedRAMP-Specific Requirements
17.1 FedRAMP Vendor Requirements
| Requirement | Application |
|---|---|
| FedRAMP authorization | Required for federal data processing |
| 3PAO assessment | Independent verification |
| Continuous monitoring | Ongoing compliance |
| Significant change | Notification requirements |
17.2 Non-FedRAMP Vendor Considerations
For vendors without FedRAMP authorization (e.g., Samsara):
| Consideration | Approach |
|---|---|
| Federal data | Not processed by non-FedRAMP vendors |
| Integration scope | Minimal necessary data |
| Compensating controls | Enhanced monitoring, encryption |
| Documentation | Risk acceptance documented |
18. Related Documents
| Document | Relationship |
|---|---|
| PLCY-SEC-001 | Security controls |
| PLCY-FED-003 | T4 API Key risk |
| PLCY-FED-005 | NIST control mapping |
19. Document Control
| Version | Date | Author | Changes |
|---|---|---|---|
| 1.0 | December 30, 2025 | Hop And Haul Team | Initial release |