Which artifact is commonly included as evidence to support control testing in the SAR?

• A. Test results, configuration snapshots, vulnerability scan outputs, interviews, and artifacts
• B. Interviews alone
• C. Configuration baselines
• D. Policy documents

Answer: (A)

In RMF, evidence for control testing in the System Assessment Report comes from a well-rounded set of artifacts that document both how the control was tested and what was found. A complete evidence package typically includes actual test results showing that the control works as intended, configuration snapshots that capture the system’s state at testing time, vulnerability scan outputs that identify and validate findings, interviews that corroborate procedures and daily practices, and other artifacts such as logs or remediation records. Together, these items provide objective verification and traceability of the control’s implementation and effectiveness. Relying on only interviews misses objective test outcomes; using only configuration baselines shows a snapshot without testing results; policy documents describe intended controls but not testing results.