ISC2 Governance, Risk and Compliance (CGRC) Practice Question

A security assessment plan (SAP) is created during the preparation phase to document the assessment objectives, scope, assessment methods, required resources, schedule, and logistical details. It must be reviewed and approved by key stakeholders-typically the system owner, authorizing official, and assessment team lead-before the assessment starts. A POA&M is produced after an assessment to track remediation of findings, an SSP describes the system's implemented security controls but does not lay out the assessment logistics, and a continuous monitoring strategy details ongoing monitoring activities rather than the one-time assessment preparation.