ISC2 Governance, Risk and Compliance (CGRC) Practice Question

NIST SP 800-37 Rev. 2 states that the authorization package presented to the Authorizing Official must, at a minimum, contain the System Security Plan (SSP), the Security Assessment Report (SAR), and the Plan of Action and Milestones (POA&M). Together, these artifacts describe the security requirements, how each control is implemented, the assessment results, and the plan for correcting any weaknesses, enabling the AO to decide whether residual risk is acceptable. The other answer options list useful but non-mandatory or incomplete document sets: awareness training records and incident plans do not replace the core package; risk registers and baseline reports lack formal assessment results; interconnection agreements and categorization reports are produced earlier in the RMF process and do not satisfy authorization package requirements on their own.