💼 SA-5 System Documentation

Description

a. Obtain or develop administrator documentation for the system, system component, or system service that describes:

Secure configuration, installation, and operation of the system, component, or service;
Effective use and maintenance of security and privacy functions and mechanisms; and
Known vulnerabilities regarding configuration and use of administrative or privileged functions; b. Obtain or develop user documentation for the system, system component, or system service that describes:
User-accessible security and privacy functions and mechanisms and how to effectively use those functions and mechanisms;
Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner and protect individual privacy; and
User responsibilities in maintaining the security of the system, component, or service and privacy of individuals; c. Document attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent and take [Assignment: organization-defined actions] in response; and d. Distribute documentation to [Assignment: organization-defined personnel or roles].

Section	Sub Sections	Internal Rules	Policies	Flags
💼 FedRAMP High Security Controls → 💼 SA-5 System Documentation (L)(M)(H)
💼 FedRAMP Low Security Controls → 💼 SA-5 System Documentation (L)(M)(H)
💼 NIST CSF v2.0 → 💼 ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained			7
💼 NIST CSF v2.0 → 💼 ID.RA-09: The authenticity and integrity of hardware and software are assessed prior to acquisition and use

Section	Sub Sections	Internal Rules	Policies	Flags
💼 SA-5(1) System Documentation _ Functional Properties of Security Controls
💼 SA-5(2) System Documentation _ Security-relevant External System Interfaces
💼 SA-5(3) System Documentation _ High-level Design
💼 SA-5(4) System Documentation _ Low-level Design
💼 SA-5(5) System Documentation _ Source Code