An information system service (e.g., telecommunications service) provided by a commercial service provider typically to a large and diverse set of consumers. The organization acquiring and/or receiving the commodity service possesses limited visibility into the management structure and operations of the provider, and while the organization may be able to negotiate service-level agreements, the organization is typically not in a position to require that the provider implement specific security controls.
Source(s):
CNSSI 4009-2015
from
NIST SP 800-53 Rev. 4
NIST SP 800-53 Rev. 4
[Superseded]
under Commodity Service
A system service provided by a commercial service provider to a large and diverse set of consumers. The organization acquiring or receiving the commodity service possesses limited visibility into the management structure and operations of the provider, and while the organization may be able to negotiate service-level agreements, the organization is typically not able to require that the provider implement specific controls.
Source(s):
NIST SP 800-37 Rev. 2
A system service provided by a commercial service provider to a large and diverse set of consumers. The organization acquiring or receiving the commodity service possesses limited visibility into the management structure and operations of the provider, and while the organization may be able to negotiate service-level agreements, the organization is typically not able to require that the provider implement specific security or privacy controls.
Source(s):
NIST SP 800-53 Rev. 5
) or https:// don't prove our archive is authentic, only that you securely accessed it. Note that we are working to fix that :)
