What is the purpose of an Assessment Plan in RMF?

• A. To outline privacy requirements only.
• B. To describe system architecture and hardware inventory.
• C. To outline how controls will be tested, who will perform tests, what methods, and the schedule.
• D. To specify incident response playbooks.

Answer: (C)

An Assessment Plan in RMF serves as the blueprint for how security controls will be tested and validated. It specifies the exact testing approach, procedures, tools, scope, environment, evidence collection, and the individuals who will perform the tests, along with the schedule. This ensures the assessment is consistent, repeatable, and traceable to the control requirements, providing a clear path from testing activities to their outcomes used for authorization decisions. Other concerns—like privacy requirements, system architecture and hardware inventory, or incident response playbooks—are addressed in separate documents or processes and not the plan that governs how controls are evaluated and when tests occur.