SA-5 System Documentation

Control statement

a. Obtain or develop administrator documentation for the system, system component, or system service that describes:
        1. Secure configuration, installation, and operation of the system, component, or service;
        2. Effective use and maintenance of security and privacy functions and mechanisms; and
        3. Known vulnerabilities regarding configuration and use of administrative or privileged functions;
    b. Obtain or develop user documentation for the system, system component, or system service that describes:
        1. User-accessible security and privacy functions and mechanisms and how to effectively use those functions and mechanisms;
        2. Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner and protect individual privacy; and
        3. User responsibilities in maintaining the security of the system, component, or service and privacy of individuals;
    c. Document attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent and take {{ insert: param, sa-05_odp.01 }} in response; and
    d. Distribute documentation to {{ insert: param, sa-05_odp.02 }}.

Parameter placeholders {{ insert: param, … }} reference FedRAMP-set values in the resolved profile. Full parameter map is preserved in the catalog database.

Covered by these Key Security Indicators