SA-5 System documentation
Requires administrator documentation covering secure configuration, installation and operation, effective use of security and privacy functions, and known vulnerabilities in privileged functions, plus user documentation
4
artefacts
1
held by a system
1
at each review
moderate
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Administrator documentation covering secure configuration, installation and operation · Cloud console / configuration management
periodic reviewEvidence produced at each review
- Distribution evidence to the defined personnel or roles · Identity provider / directory
governing documentDocuments that govern the control
- User documentation covering security and privacy functions and user responsibilities · Policy repository / GRC workspace
- Record of action taken where documentation was unavailable or inadequate · Document repository
First move
Start with the 1 of 4 artefacts that already live in a system (Cloud console / configuration management); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Documentation exists for the product generally but not for the configuration deployed here
- No documented response where a supplier could not provide documentation
- Documentation held by one engineer and never distributed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSA-4 Acquisition process · SA-8 Security and privacy engineering principles