Skip to main content
CMDashCybersecurity Maturity Dashboard

SA-5 System documentation

FedRAMP Moderate · Rev 5

a. Obtain or develop administrator documentation for the system, system component, or system service that describes: 1. Secure configuration, installation, and operation of the system, component, or service; 2. Effective use and maintenance of security and privacy functions and mechanisms; and 3. Known vulnerabilities regarding configuration and use of administrative or privileged functions; b. Obtain or develop user documentation for the system, system component, or system service that describes: 1. User-accessible security and privacy functions and mechanisms and how to effectively use those functions and mechanisms; 2. Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner and protect individual privacy; and 3. User responsibilities in maintaining the security of the system, component, or service and privacy of individuals; c. Document attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent and take [actions] in response; and d. Distribute documentation to [personnel or roles].

Quoted verbatim from NIST SP 800-53 Rev 5 (OSCAL catalog), which is in the public domain.

No cross-framework mapping is seeded for this control. That is stated rather than filled in: a mapping nobody authored is worse than a gap you can see.

Track SA-5 with evidence behind it

In CMDash this control is a row with an owner, a status, uploaded evidence kept with its full history, and an export an assessor can read.

SA-5 System documentation — FedRAMP Moderate | CMDash