SA-5: System Documentation

An OSCAL Control

Statement

a.
Obtain or develop administrator documentation for the system, system component, or system service that describes:
- 1.
  Secure configuration, installation, and operation of the system, component, or service;
- 2.
  Effective use and maintenance of security and privacy functions and mechanisms; and
- 3.
  Known vulnerabilities regarding configuration and use of administrative or privileged functions;
b.
Obtain or develop user documentation for the system, system component, or system service that describes:
- 1.
  User-accessible security and privacy functions and mechanisms and how to effectively use those functions and mechanisms;
- 2.
  Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner and protect individual privacy; and
- 3.
  User responsibilities in maintaining the security of the system, component, or service and privacy of individuals;
c.
Document attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent and take in response; and
d.
Distribute documentation to .