Which documents are typically used to support the system authorization decision?

• A. SSP, SAR, risk assessment, POA&M, and monitoring plan.
• B. Project charter.
• C. Source code.
• D. Incident reports.

Answer: (A)

The key idea here is what documents form the official authorization package used to decide if a system can operate securely. The authorization package in RMF includes the System Security Plan (SSP), the Security Assessment Report (SAR), the risk assessment, the Plan of Actions and Milestones (POA&M), and the monitoring plan. The SSP describes the system, its boundaries, and the implemented security controls; the SAR summarizes the results of the security assessment and any identified weaknesses; the risk assessment provides an analysis of threats, vulnerabilities, and residual risk; the POA&M tracks remediation actions and timelines; and the monitoring plan outlines ongoing activities to continuously evaluate controls. Together, these artifacts give the authorizing official a comprehensive, evidence-based view of the system’s security posture and how it will be monitored over time.

Project charters, source code, and incident reports do not constitute the standard authorization package. A project charter is about project management goals and scope, not security control evidence. Source code isn’t the formal set of artifacts used to substantiate a security authorization, and incident reports, while informative about past issues, don’t by themselves provide the structured, ongoing evidence required for an authorization decision.