RMF Steps, Tasks, And Outcomes Practice Test

The System Security Plan (SSP) is the central RMF artifact that documents which security controls are selected for a system and describes how those controls will be implemented. It lays out the system boundary, the operating environment, and how the chosen controls meet security requirements. The SSP specifies the baseline controls, any tailoring, roles and responsibilities, and how the controls will be tested, assessed, and maintained over time. It also connects to the plan for ongoing risk management, often incorporating or referencing the plan of actions and milestones for addressing any gaps. This makes the SSP the key document used during authorization to explain what controls exist, how they’re applied, and how the system will be operated securely. For contrast, a Project Charter focuses on project scope and objectives; an Incident Response Plan details how to detect and respond to security incidents; and a Business Continuity Plan outlines strategies to maintain operations during disruptions.