How does RMF ensure accountability for security decisions?

• A. Through documented roles, responsibilities, artifacts, and auditable evidence for every step.
• B. By relying on informal communications
• C. By outsourcing all decisions
• D. By keeping records offline only

Answer: (A)

RMF ensures accountability by making security decisions traceable through formal roles and a complete, auditable record of every step. In RMF, there are clearly defined responsibilities—such as who owns the system, who assesses controls, and who is the Authorizing Official approving the risk posture. Decisions and actions are captured in artifacts that accompany the authorization package, including the System Security Plan, the Security Assessment Report, and the Plan of Actions and Milestones. These artifacts document which controls were selected and implemented, how they were tested, the results of those tests, the residual risk, and the rationale for the authorization decision. The authorization, often formalized as an ATO, creates a documented point of accountability for accepting residual risk and authorizing system operation. Continuous monitoring then keeps this trail up to date, with ongoing evidence of changes, re-assessments, and any new risk decisions.

This contrasts with informal communications, which don’t leave a verifiable trail, outsourcing decisions, which can obscure responsibility, or keeping records offline only, which undermines accessibility and auditability. The RMF approach ensures you can answer who decided, what was decided, when, why, and with what evidence.