SA-5: System Documentation

Statement

• a.

  Obtain or develop administrator documentation for the system, system component, or system service that describes:

  • 1.

    Secure configuration, installation, and operation of the system, component, or service;

  • 2.

    Effective use and maintenance of security and privacy functions and mechanisms; and

  • 3.

    Known vulnerabilities regarding configuration and use of administrative or privileged functions;

• b.

  Obtain or develop user documentation for the system, system component, or system service that describes:

  • 1.

    User-accessible security and privacy functions and mechanisms and how to effectively use those functions and mechanisms;

  • 2.

    Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner and protect individual privacy; and

  • 3.

    User responsibilities in maintaining the security of the system, component, or service and privacy of individuals;

• c.

  Document attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent and take actions in response; and

• d.

  Distribute documentation to personnel or roles .