❓ Week 4 Knowledge Check – Documentation & Assessment Essentials

Which document outlines all implemented controls and their status?

What is the primary goal of the Security Assessment Report (SAR)?

True or False: A POA&M should only be created after system authorization.

Which of the following is not a valid security assessment technique?

What’s one risk of submitting incomplete documentation in an ATO package?

What makes a good SSP template effective for auditors and assessors?

Match the document with its purpose

A system has 4 moderate-risk findings. Which document would track corrective actions and milestones for each?

Which component of the SA&A process verifies that controls are implemented as described?

What is a benefit of peer review during documentation exercises?