# SA-2 — Allocation of Resources

- **Control ID:** SA-2
- **Family:** [SA](/md/families/SA.md)
- **Baselines:** low, moderate, high
- **Enhancement of:** No content available.

## Description

Determine the high-level information security and privacy requirements for the system or system service in mission and business process planning; Determine, document, and allocate the resources required to protect the system or system service as part of the organizational capital planning and investment control process; and Establish a discrete line item for information security and privacy in organizational programming and budgeting documentation.

## Discussion

Resource allocation for information security and privacy includes funding for system and services acquisition, sustainment, and supply chain-related risks throughout the system development life cycle.

## Implementation guidance

No content available.

## CSF 2.0 subcategories

No content available.

## Related controls

- [PL-7](/md/controls/PL-7.md)
- [PM-3](/md/controls/PM-3.md)
- [PM-11](/md/controls/PM-11.md)
- [SA-9](/md/controls/SA-9.md)
- [SR-3](/md/controls/SR-3.md)
- [SR-5](/md/controls/SR-5.md)

---

Derived from official NIST publications (NIST SP 800-53 Rev 5 and NIST CSF 2.0). nistcontrols.com is not affiliated with NIST.