ISC2 Governance, Risk and Compliance (CGRC) Practice Question

A system security plan (SSP) is the authoritative document that describes the information system's purpose, environment, boundaries, and the specific security controls implemented or planned. It maps each control to organizational and regulatory requirements, identifies responsible roles, and thus demonstrates how the control baseline satisfies the system's risk posture. An incident response plan focuses only on detecting and handling incidents, not on documenting every implemented control. A configuration management policy defines organizational change-control expectations but does not capture the full control set for a particular system. A security assessment report records test results and residual risks after controls are evaluated, but it is separate from the plan that defines and organizes those controls in the first place. Therefore, requesting the SSP closes the documentation gap identified by the auditors.