What does 'evidence sufficiency' mean in RMF assessments?

• A. Evidence sufficiency means only test results are needed.
• B. Evidence sufficiency is enough high-quality evidence to support all findings and conclusions.
• C. Evidence sufficiency requires management approvals only.
• D. Evidence sufficiency relates to password strength metrics.

Answer: (B)

Evidence sufficiency in RMF assessments means having enough high-quality evidence to support all findings and conclusions about how well the security controls are implemented and operating. It isn’t just a single test result; it’s a complete set of credible data from multiple sources—tests, artifacts, interviews, demonstrations—that covers the full scope of each control. The evidence should be reliable, timely, and representative, showing that controls meet the requirements and function as intended so risk decisions can be made with confidence.

This concept goes beyond just test outcomes. It requires corroborating information that links findings to the actual risk posture and demonstrates consistency across methods and sources. It’s not about management approvals or narrow metrics like password strength; those do not by themselves prove that controls are effective. When evidence sufficiency is achieved, the assessment team can justify conclusions and support a sound authorization decision with a solid evidentiary basis.