NIST SP 800-53 Rev 5
SA - System and Services Acquisition

NIST SP 800-53 Rev 5 NIST800-SA-5: SA-5 System Documentation

a. Obtain or develop administrator documentation for the system, system component, or system service that describes: 1. Secure configuration, installation, and operation of the system, component, or service; 2. Effective use and maintenance of security and privacy functions and mechanisms; and 3. Known vulnerabilities regarding configuration and use of administrative or privileged functions; b. Obtain or develop user documentation for the system, system component, or system service that describes: 1. User-accessible security and privacy functions and mechanisms and how to effectively use those functions and mechanisms; 2. Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner and protect individual privacy; and 3. User responsibilities in maintaining the security of the system, component, or service and privacy of individuals; c. Document attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent and take [Assignment: organization-defined actions] in response; and d. Distribute documentation to [Assignment: organization-defined personnel or roles].

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 32 controls across 19 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO/IEC 42001:2023 · 6 controls

  • 7.5.2 Creating and updating documented information
  • A.4.2 Resource documentation
  • A.6.2.3 Documentation of AI system design and development
  • A.6.2.7 AI system technical documentation
  • A.8.2 System documentation and information for users
  • A.9.4 Intended use of the AI system

ISO 22301:2019 · 4 controls

  • 7.5.1 General
  • 7.5.2 Creating and updating
  • 7.5.3 Control of documented information
  • 8.4.4 Business continuity plans

C5 (Germany) · 2 controls

  • C5-PI-01 Documentation and safety of input and output interfaces
  • C5-PSS-01 Guidelines and Recommendations for Cloud Customers

EU AI Act · 2 controls

HIPAA Security Rule · 2 controls

NIST SP 800-218 · 2 controls

SOC 2 · 2 controls

  • SOC2-CC2.1 CC2.1 Relevant, quality information to support internal control (COSO principle 13)
  • SOC2-CC5.3 CC5.3 Deploying controls through policies and procedures (COSO principle 12)

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

FedRAMP High · 1 control

  • SA-5 System Documentation

FedRAMP Moderate · 1 control

  • SA-5 System Documentation

ISO 27001:2022 · 1 control

  • 5.37 Documented operating procedures

ISO 27002:2022 · 1 control

  • 5.37 Documented operating procedures

ISO 27701:2019 · 1 control

  • 5.5.5 Documented information

NIST SP 800-160 · 1 control

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-53 Rev 5 HIGH · 1 control

  • SA-5 SA-5 System Documentation

NIST SP 800-53 Rev 5 LOW · 1 control

  • SA-5 SA-5 System Documentation

NIST SP 800-53 Rev 5 MODERATE · 1 control

  • SA-5 SA-5 System Documentation

NIST SP 800-66 Rev 2 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in SA - System and Services Acquisition

You are reading one control. How much of NIST SP 800-53 Rev 5 have you already done?

NIST SP 800-53 Rev 5 NIST800-SA-5 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-53 Rev 5 your existing evidence covers. Hold ISO 27001:2022 and 163 of 1014 NIST SP 800-53 Rev 5 controls already carry evidence.

If you hold ISO 27001:202216.1% covered · 851 gapsIf you hold ISO 27002:202210.8% covered · 904 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.110.2% covered · 911 gapsIf you hold CIS Controls v810.1% covered · 912 gapsIf you hold NIST SP 800-171 Rev 310.1% covered · 912 gapsIf you hold C5 (Germany)9.6% covered · 917 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 342 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 32 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-53 Rev 5 controls