What describes the Assessment Plan process?

• A. Documentation needed to conduct the assessments is provided to the assessor or assessment team.
• B. Security and privacy assessment plans are developed and documented.
• C. Security and privacy assessment plans are reviewed and approved to establish the expectations for the control assessments and the level of effort required.
• D. Security and privacy assessment plans are developed and documented, and security and privacy assessment plans are reviewed and approved to establish the expectations for the control assessments and the level of effort required.

Answer: (D)

The Assessment Plan is about defining what will be assessed, how it will be done, who will do it, when it will occur, and the level of effort required. It must be both developed and documented and then formally reviewed and approved before assessments proceed. This ensures there is a concrete, sanctioned plan that sets clear expectations for how the control assessments will be conducted and how much effort they will require. The option that combines developing and documenting the plan with subsequent review and approval best captures this full process, making it the most complete description. The other descriptions miss either the planning step, the approval step, or both, so they don’t fully describe how the Assessment Plan is intended to function.