System Documentation

frameworkNIST SP 800-53 Rev 5.2 sectionSA System and Services Acquisition csf 2.0ID.AM-02 ID.RA-09 topics— frameworks1 0 0

Official texta. Obtain or develop administrator documentation for the system, system component, or system service that describes:
1. Secure configuration, installation, and operation of the system, component, or service;
2. Effective use and maintenance of security and privacy functions and mechanisms; and
3. Known vulnerabilities regarding configuration and use of administrative or privileged functions;
b. Obtain or develop user documentation for the system, system component, or system service that describes:
1. User-accessible security and privacy functions and mechanisms and how to effectively use those functions and mechanisms;
2. Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner and protect individual privacy; and
3. User responsibilities in maintaining the security of the system, component, or service and privacy of individuals;
c. Document attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent and take [Assignment: organization-defined actions] in response; and
d. Distribute documentation to [Assignment: organization-defined personnel or roles].NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of SA-5 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.AM-02 ID.RA-09	Inventories of software, services, and systems managed by the organization are maintained; The authenticity and integrity of hardware and software are assessed prior to acquisition and use	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.RA-09: related, not a mapping
ISO 27001	A.5.37 Clause 7.5.1 Clause 7.5.2 Clause 7.5.3	Documented operating procedures; General…	Crosswalk	NIST SP 800-53 → ISO 27001 mapping 4 loosely related (not mappings) A.5.9 Inventory of information and other associated assets Loosely related Only shares CSF ID.AM-02: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF ID.RA-09: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF ID.RA-09: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF ID.RA-09: related, not a mapping
CIS v8.1	CIS 2.1 CIS 1.2 CIS 1.3 CIS 1.4	Establish and Maintain a Software Inventory; Address Unauthorized Assets…	Loosely related	No mapping. Only shares CSF ID.AM-02: related, not a mapping +4 more loosely related (not mappings) CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-02: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-02: related, not a mapping CIS 2.4 Utilize Automated Software Inventory Tools Loosely related Only shares CSF ID.AM-02: related, not a mapping CIS 16.4 Establish and Manage an Inventory of Third-Party Software Components Loosely related Only shares CSF ID.AM-02: related, not a mapping
SOC 2	CC6.1 CC9.2	Logical access security over information assets; Managing vendor and business partner risk	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.RA-09: related, not a mapping
PCI DSS	6.4.3 6.3.2 9.5.1.1 12.5.1	Payment page scripts authorised and integrity-checked; Inventory of custom software and its components…	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.RA-09: related, not a mapping +1 more loosely related (not mappings) 12.8.1 List of third-party service providers kept Loosely related Only shares CSF ID.AM-02: related, not a mapping
CMMC	AC.L2-3.1.20 AC.L2-3.1.21 RA.L2-3.11.1	External Connections; Portable Storage Use…	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.RA-09: related, not a mapping
HIPAA	§164.308(b)(4)§164.314(a)§164.314(a)(2)(i)§164.314(a)(2)(iii)	Written Contract or Other Arrangement; Business Associate Contracts or Other Arrangements…	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.RA-09: related, not a mapping +8 more loosely related (not mappings) §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF ID.AM-02: related, not a mapping §164.310(d) Device and Media Controls Loosely related Only shares CSF ID.AM-02: related, not a mapping §164.310(d)(2)(iii) Accountability Loosely related Only shares CSF ID.AM-02: related, not a mapping §164.312(c) Integrity Loosely related Only shares CSF ID.RA-09: related, not a mapping …and 4 more in the downloads
GDPR	Art.28(1)Art.30(1)	Processor; Records of processing activities	Loosely related	No mapping. Only shares CSF ID.RA-09, ID.AM-02: related, not a mapping
NIS2	6.1 12.4	Security in acquisition of ICT services, ICT systems or ICT products; Asset inventory	Loosely related	No mapping. Only shares CSF ID.RA-09, ID.AM-02: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-02: related, not a mapping
DORA	Art.8(1)Art.8(4)Art.8(6)Art.28(2)	Identification; Identification…	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.RA-09: related, not a mapping +2 more loosely related (not mappings) Art.29(1) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF ID.RA-09: related, not a mapping Art.29(2) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF ID.RA-09: related, not a mapping
CPS 234	Para 16 Para 20 Para 22	Assess third parties' information security capability; Classify information assets by criticality and sensitivity…	Loosely related	No mapping. Only shares CSF ID.RA-09, ID.AM-02: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.AM-02: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.