03.16.01 Security engineering principles
Applying organization-defined systems security engineering principles when developing or modifying the system and its components; new in Rev. 3.
03.16 System and services acquisition
Rev. 3 system and services acquisition requirements, a family new in Rev. 3: security engineering principles, replacing unsupported components and security requirements for external service providers.
03.16.02 Unsupported system components
Replacing components once the developer, vendor or manufacturer stops supporting them, and providing risk mitigation or alternative support for those that cannot be replaced; new in Rev. 3.
03.16.03 External system services
Requiring providers of external system services that handle CUI to meet defined security requirements, documenting roles and shared responsibilities, and monitoring provider compliance on an ongoing basis; new in Rev. 3.
