Who typically conducts the security control assessment and prepares the Security Assessment Report (SAR)?

• A. System Owner
• B. Authorizing Official
• C. Information System Security Officer
• D. Security Control Assessor (or assessors) and assessment team

Answer: (D)

In RMF, the task of evaluating implemented security controls and documenting the results falls to an independent Security Control Assessor and the assessment team. They test the controls, gather evidence, and compile the Security Assessment Report (SAR), which lays out how well each control works, what vulnerabilities were found, and the residual risk.

The SAR then serves as the primary input for the Authorizing Official to make a risk-based authorization decision. The System Owner is responsible for implementing and maintaining the controls, and the Information System Security Officer supports the process, but the actual assessment and SAR preparation are the work of the Security Control Assessor and assessment team.