System Administrator Government Off-the-Shelf Applications (SAGA) Practice Exam

The key idea is to implement a full lifecycle approach to security controls rather than treating them as a one-time setup. In SAGA deployments, you start by mapping NIST SP 800-53 controls to the system’s actual requirements, then put in place the safeguards those controls mandate—covering areas like access control (who can do what), audit and accountability (keeping logs and being able to review them), identification and authentication (verifying user identities), and system integrity (protecting the system from tampering). Beyond implementation, you document exactly how each control is satisfied in the system security plan and related artifacts. To stay compliant over time, you continuously monitor the controls and perform periodic assessments to verify they remain effective as the environment evolves, vulnerabilities emerge, or new threats appear. This ongoing, evidence-based process is essential for maintaining an Authorization to Operate and is far more robust than addressing only one facet (like encryption at rest) or neglecting monitoring altogether.