In RMF, once a system is authorized, it stays in a continuous monitoring state. When a change is made to the information system, you perform a security impact assessment to see if the change affects the security controls or the risk posture. If there is an impact, you update the System Security Plan to reflect the new controls or implementations and revise the Plan of Actions and Milestones with any remediation steps. Depending on how the change shifts risk, you may need a new authorization decision to allow operation under the updated risk level. Changes aren’t ignored, they don’t automatically revoke authorization, and they don’t require re-enrolling all users.

In RMF, the Security Assessment Report captures the results of the security testing conducted on the system. It documents which controls were tested, how they were tested, the evidence collected, and an assessment of whether each control is effective and operating as intended. This provides the Authorizing Official with a clear view of the system’s risk posture and residual risk, informing the authorization decision. The SAR is separate from the System Security Plan, which defines system boundaries and responsibilities, and from the Plan of Actions and Milestones, which tracks remediation actions. It isn’t the authorization itself; it supports the decision by presenting the testing results, evidence, and overall control effectiveness.

The System Security Plan (SSP) is the central RMF artifact that documents which security controls are selected for a system and describes how those controls will be implemented. It lays out the system boundary, the operating environment, and how the chosen controls meet security requirements. The SSP specifies the baseline controls, any tailoring, roles and responsibilities, and how the controls will be tested, assessed, and maintained over time. It also connects to the plan for ongoing risk management, often incorporating or referencing the plan of actions and milestones for addressing any gaps. This makes the SSP the key document used during authorization to explain what controls exist, how they’re applied, and how the system will be operated securely. For contrast, a Project Charter focuses on project scope and objectives; an Incident Response Plan details how to detect and respond to security incidents; and a Business Continuity Plan outlines strategies to maintain operations during disruptions.

Independence in assessment means the people conducting the evaluation are free from conflicts of interest and not involved in operating or managing the system being assessed, so their findings are objective and credible. The best choice reflects both the act of selecting someone to perform the control assessments and ensuring they have the appropriate level of independence. That combination ensures the assessment results can be trusted for risk decisions and authorization. Choosing only the assessor without guaranteeing independence leaves room for potential bias. Claiming independence isn’t considered ignores a fundamental requirement for credible assessment. Holding independence without specifying the selection of an assessor leaves the process open to questions about who is evaluating and how they’re chosen. The option that includes both selecting the assessor and achieving the right level of independence best captures how independence is integrated into the assessment process.