In management controls, SA stands for which?

• A. System and Services Acquisition
• B. Security Analysis
• C. Service Agreement
• D. System Administration

Answer: (A)

System and Services Acquisition is the term used for the management controls family that focuses on how information systems and the services that support them are procured and managed. This area ensures security is built into the acquisition process—from selecting vendors and evaluating risks to defining security requirements in contracts and overseeing external service providers. It covers how systems are acquired, developed, integrated, and maintained, and how ongoing risk is managed with suppliers and outsourced services. The other options don’t align with the formal control family name used in management controls: they aren’t recognized as the official SA family, and they describe other concepts (security analysis, contractual service agreements, or system administration) that aren’t the designated management-controls category.