Which items are included in the authorization package alongside privacy considerations?

• A. Training records and user feedback
• B. The SSP and SAR only
• C. The SSP, SAR, risk assessment, POA&M, privacy considerations, and boundary documents
• D. Incident logs and access control lists

Answer: (C)

The authorization package is the formal bundle of documentation an Authorizing Official uses to grant an ATO, bringing together security and privacy risk information with clear system boundaries. It includes documents that show how the system is protected and how privacy is handled. The System Security Plan describes the implemented controls and how they meet requirements, while the Security Assessment Report records how those controls were evaluated. The risk assessment provides an overall view of potential threats and risk levels, and the Plan of Actions and Milestones tracks what remains to be fixed. Privacy considerations address how personal data is protected and the privacy obligations the system must meet, and boundary documents define exactly what is in scope for the system. Together, these items give a complete picture for risk decisions and authorization.

Training records and user feedback are useful for training readiness and user experience, but they aren’t the formal risk and control assessment content used for authorization. Incident logs and access control lists are operational artifacts used for monitoring and auditing, not part of the official authorization package.