Which document records the results of the security assessment of controls, including findings and evidence?

• A. System Security Plan (SSP)
• B. Security Assessment Report (SAR)
• C. Authorization to Operate (ATO)
• D. Plan of Actions and Milestones (POA&M)

Answer: (B)

The key idea is recognizing which RMF artifact records what comes out of the security assessment. The Security Assessment Report is designed to capture the results of evaluating the implemented security controls, including the findings, the evidence collected (such as test results, scans, artifacts), and the assessed impact or risk of any gaps. It acts as the formal record of how well the controls function and what weaknesses were discovered, along with recommendations for mitigation. This report then informs decisions about whether the system should be authorized to operate.

The other documents serve different purposes: the System Security Plan describes which controls exist and how they’re implemented; the Authorization to Operate is the formal approval to operate the system; and the Plan of Actions and Milestones tracks remediation steps for identified issues.