RMF Steps, Tasks, And Outcomes Practice Test

What is the purpose of the Security Assessment Report (SAR) in RMF?

To list deficiencies and remediation actions and tracks milestones. To define system boundaries and security responsibilities. To authorize system operation. To document the results of control testing, evidence, and overall control effectiveness.

Correct Answer:

To document the results of control testing, evidence, and overall control effectiveness.

Explanation:

In RMF, the Security Assessment Report captures the results of the security testing conducted on the system. It documents which controls were tested, how they were tested, the evidence collected, and an assessment of whether each control is effective and operating as intended. This provides the Authorizing Official with a clear view of the system’s risk posture and residual risk, informing the authorization decision. The SAR is separate from the System Security Plan, which defines system boundaries and responsibilities, and from the Plan of Actions and Milestones, which tracks remediation actions. It isn’t the authorization itself; it supports the decision by presenting the testing results, evidence, and overall control effectiveness.

Access more questions from this quiz

Continue to RMF Steps, Tasks, and Outcomes Practice Test for more practice questions and the full quiz experience.

Access More Questions