ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

The security (or system security) plan is produced early in the project to describe the system environment, list selected and inherited security controls, identify responsible roles, and define how the controls will be monitored for effectiveness. This detailed overview supports the Authorizing Official's risk-based decision to authorize the system.

• An incident response plan focuses on detecting, containing, and recovering from security events after deployment, not on defining baseline controls up front.
• A verification and validation test report documents test execution results and defects discovered; it does not establish controls or monitoring strategies.
• A configuration management plan outlines how changes are proposed, reviewed, and implemented but does not provide the comprehensive control catalog or authorization information required at project initiation.