ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

NIST's Risk Management Framework specifies that the authorization package submitted to the Authorizing Official contains three core documents: the System Security Plan (SSP), which describes the system and its implemented controls; the Security Assessment Report (SAR), which documents the results of testing those controls; and the Plan of Action and Milestones (POA&M), which lists residual weaknesses along with planned remediation steps and timelines. Together these give the Authorizing Official enough information to determine if residual risk is acceptable. The other answer sets omit at least one of these mandatory artifacts and include documents that, while useful, are not required elements of the authorization package itself.