ISC2 Governance, Risk and Compliance (CGRC) Practice Question

The Security Assessment Report (SAR) is produced by the assessor after control testing is complete. It documents the methods used, evidence examined, control-by-control results, identified weaknesses or deficiencies, and provides recommendations. The Authorizing Official relies on the SAR to judge overall control effectiveness and residual risk before making an authorization decision.

• The System Security Plan (SSP) describes the system, its environment, and the controls that are implemented or planned-it does not present test results.
• The Plan of Action and Milestones (POA&M) captures corrective actions the system owner will take to remediate findings; it is populated after reviewing the SAR, not during assessment reporting.
• A Continuous Monitoring Strategy outlines how security posture will be monitored post-authorization and likewise does not contain the assessor's detailed findings.