What is the role of the System Security Plan (SSP) within RMF artifacts?

• A. It documents the control implementation, system boundaries, and is a core RMF output.
• B. It is optional and rarely used
• C. It only records financial costs
• D. It replaces the SAR

Answer: (A)

In RMF, the System Security Plan is the formal blueprint that shows how a system meets security requirements. It lays out the system boundaries and environment of operation, the security categorization, and the specific controls in place. It describes how each control is implemented, configured, and managed, who is responsible, and how the system is monitored and maintained at baseline. Because all of this information is collected in one authoritative document, the SSP becomes a core RMF artifact used by assessors and authorizers to understand how the system is protected and where residual risks lie. It supports the authorization decision and guides ongoing monitoring. It isn’t optional, it isn’t about costs, and it doesn’t replace the Security Assessment Report, which records the results of the control assessments.