Which task outcome completes security and privacy assessment reports?

• A. Security and privacy assessment reports are completed.
• B. Remediation actions address deficiencies in the controls and are taken.
• C. An authorizing package is developed for submission to the authorizing official.
• D. Ongoing assessments of control effectiveness are conducted.

Answer: (A)

Completing the assessment reports marks the end of the security and privacy assessment activity. Once tests of the controls are done, all findings, evidence, and evaluations of control effectiveness are compiled into the Security Assessment Report and the Privacy Assessment Report. Finishing these reports creates a formal record of the current security and privacy posture that decision-makers can review and base further actions on. The other steps—remediation of deficiencies, building an authorization package, and ongoing monitoring—happen after this reporting is complete, as separate activities that address identified gaps, obtain authorization, or ensure continued control effectiveness over time.