Skip to content
ATO Pathways
  Log In

SA-5: System Documentation

An OSCAL Control

Statement

    • a.

      Obtain or develop administrator documentation for the system, system component, or system service that describes:

      • 1.

        Secure configuration, installation, and operation of the system, component, or service;

      • 2.

        Effective use and maintenance of security and privacy functions and mechanisms; and

      • 3.

        Known vulnerabilities regarding configuration and use of administrative or privileged functions;

    • b.

      Obtain or develop user documentation for the system, system component, or system service that describes:

      • 1.

        User-accessible security and privacy functions and mechanisms and how to effectively use those functions and mechanisms;

      • 2.

        Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner and protect individual privacy; and

      • 3.

        User responsibilities in maintaining the security of the system, component, or service and privacy of individuals;

    • c.

      Document attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent and take in response; and

    • d.

      Distribute documentation to .