Insufficient Technical Documentation

Incomplete Class
Structure: Simple
Description

This weakness occurs when a software or hardware product lacks comprehensive technical documentation. Missing or incomplete details about the system's architecture, interfaces, design, configuration, or operation make it difficult to understand, maintain, and secure the product effectively.

Extended Description

Insufficient documentation creates a major maintenance burden and indirectly harms security. When developers or security consultants can't quickly understand how a system is built and functions, they spend excessive time reverse-engineering it instead of efficiently finding and fixing vulnerabilities. This delay increases the window of exposure for potential flaws. For hardware, the absence of formal engineering artifacts—like HDLs, netlists, or Bills of Materials—makes post-manufacture verification nearly impossible. Without these references, you cannot reliably confirm that the design operates within specifications, is free from unexpected behavior, or meets security and safety tolerances.

Common Consequences 1
Scope: Other

Impact: Varies by ContextHide ActivitiesReduce ReliabilityQuality DegradationReduce Maintainability

Without a method of verification, one cannot be sure that everything only functions as expected.

Potential Mitigations 1
Phase: DocumentationArchitecture and Design
Ensure that design documentation is detailed enough to allow for post-manufacturing verification.
Observed Examples 1
CVE-2022-3203A wireless access point manual specifies that the only method of configuration is via web interface (Insufficient Technical Documentation), but there is an undisclosed telnet server that was activated by default (Hidden Functionality).
References 2
Categories of Security Vulnerabilities in ICS
Securing Energy Infrastructure Executive Task Force (SEI ETF)
09-03-2022
ID: REF-1248
Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions Draft Guidance for Industry and Food and Drug Administration Staff (DRAFT GUIDANCE)
FDA
08-04-2022
ID: REF-1254
Applicable Platforms
Languages:
Not Language-Specific : Undetermined
Technologies:
Not Technology-Specific : UndeterminedICS/OT : Undetermined
Modes of Introduction
Architecture and Design
Documentation
Taxonomy Mapping
  • ISA/IEC 62443
  • ISA/IEC 62443
  • ISA/IEC 62443
  • ISA/IEC 62443
  • ISA/IEC 62443
  • ISA/IEC 62443
  • ISA/IEC 62443
  • ISA/IEC 62443
  • ISA/IEC 62443
  • ISA/IEC 62443