Which RMF artifact is used to record the results of the control assessment, including findings and evidence?

• A. Plan of Actions and Milestones (POA&M)
• B. Authorization to Operate (ATO)
• C. Security Assessment Report (SAR)
• D. System Security Plan (SSP)

Answer: (C)

The artifact that records the results of the control assessment, including findings and evidence, is the Security Assessment Report. This document captures which controls were tested, how they were evaluated, and the actual evidence collected during testing. It notes any weaknesses or gaps, their severity, and recommended mitigations, providing the evidence base that the authorizing official uses to decide on an Authorization to Operate (ATO) or required remediation. The other artifacts serve different roles: the System Security Plan describes the system and its implemented controls; the Plan of Actions and Milestones tracks remediation steps; and the Authorization to Operate is the formal approval to operate after the assessment.