ISC2 Governance, Risk and Compliance (CGRC) Practice Question

The Security Assessment Plan (SAP) is built from information that describes how the system is architected, the categorization, and how each NIST 800-53 control is implemented. That level of detail is found in the System Security Plan (SSP). Supplying the SSP lets the 3PAO map implemented controls to test procedures and determine assessment boundaries. A POA&M lists known weaknesses after an assessment, so it is not yet available. An Authorization to Operate letter is issued only after the assessment is complete. The continuous monitoring strategy, while important, is a separate document that does not give the 3PAO the full control implementation narrative required to develop the SAP.