A lot is missing in this as it mentions only what SAS knows.
As important as that is what does SAS not know, but is part of regulations business policies etc....

Going into related OS docs for scripting and configuration.
The backgrounds on what regulators have described and what is within then business policy
Questions from riskmanagers and auditors forcing you into their world with all kinds of technical monitoring and security procedures (SIEM hardening).
As with release management (infra and business apart) procedures and version management.
At least the hints to find some of those external resources should be mentioned somewhere.