|

controlSA-5

System Documentation (SA-5)

Obtain or develop administrator documentation for the system, system component, or system service that describes: Obtain or develop user documentation for the system, system component, or system service that describes: Document attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent and take [organization-defined] in response; and Distribute documentation to [organization-defined].

Security Baselines

LOWMODERATEHIGH

acquisitionsdlcservicessupply-chain

Why These Connect

Maps To5

These are equivalent or closely aligned requirements in other frameworks.

Baselined In3

This control is included in the linked security baseline (LOW, MODERATE, or HIGH).

Supports35

These related controls work together — a change to one may affect the others.

Enhances5

These enhancements add specific capabilities or refinements to the base control.

Related Controls(22)

CM-4Impact Analyses (CM-4)

CM-6Configuration Settings (CM-6)

CM-7Least Functionality (CM-7)

CM-8System Component Inventory (CM-8)

PL-2System Security and Privacy Plans (PL-2)

PL-4Rules of Behavior (PL-4)

PL-8Security and Privacy Architectures (PL-8)

PS-2Position Risk Designation (PS-2)

PS-7External Personnel Security (PS-7)

SA-3System Development Life Cycle (SA-3)

SA-4Acquisition Process (SA-4)

SA-8Security and Privacy Engineering Principles (SA-8)

SA-9External System Services (SA-9)

SA-10Developer Configuration Management (SA-10)

SA-11Developer Testing and Evaluation (SA-11)

SA-15Development Process, Standards, and Tools (SA-15)

SA-16Developer-provided Training (SA-16)

SA-17Developer Security and Privacy Architecture and Design (SA-17)

SI-12Information Management and Retention (SI-12)

SR-3Supply Chain Controls and Processes (SR-3)

SC-3Security Function Isolation (SC-3)

SR-5Acquisition Strategies, Tools, and Methods (SR-5)

Cross-Framework Mappings(5)

ID.AM-02ID.AM-02Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

ID.RA-09ID.RA-09Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

ISO 27001ISO/IEC 27001:20224 mappingsFinal

NIST OLIR informative reference — SP 800-53 Rev 5 to ISO/IEC 27001:2022

ID.AM-02ID.AM-02Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

ID.RA-09ID.RA-09Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

Organization-Defined Parameters(2)

Assignmentorganization-defined actions

Assignmentorganization-defined personnel or roles

Control Enhancements(5)

SA-5(1)Functional Properties of Security Controls (SA-5(1))W

SA-5(2)Security-relevant External System Interfaces (SA-5(2))W

SA-5(3)High-level Design (SA-5(3))W

SA-5(4)Low-level Design (SA-5(4))W

SA-5(5)Source Code (SA-5(5))W

See Also

@SP 800-53 Overview ⚖Compare Baselines