Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX F

•
Security and privacy assessment reports;131 and
•
Plans of action and milestones.
The executive summary provides a consolidated view of the security and privacy information in
the authorization package. The executive summary identifies and highlights risk management
issues associated with protecting information systems and the environments in which the
systems operate. The summary provides the essential information needed by the authorizing
official to understand the security and privacy risks to the organization's operations and assets,
individuals, other organizations, and the Nation. The executive summary information can be
used by the authorizing official to make informed, risk-based decisions regarding the operation
and use of the system or the provision of common controls that can be inherited by
organizational systems.
The security and privacy plans provide an overview of the security and privacy requirements and
describe the controls in place or planned for meeting those requirements.132 The plans provide
sufficient information to understand the intended or actual implementation of the controls
implemented within the system and indicate the controls that are implemented via inherited
common controls. Additionally, privacy plans describe the methodologies and metrics that will
be used to assess the controls. The security and privacy plans may also include as supporting
appendices or as references, additional documents such as a privacy impact assessment,
interconnection security agreements, security and privacy configurations, contingency plan,
configuration management plan, supply chain risk management plan, incident response plan,
and system-level continuous monitoring strategy. The security and privacy plans are updated
whenever events dictate changes to the controls implemented within or inherited by the
system.
The security and privacy assessment reports, prepared by the control assessor or generated by
automated security/privacy management and reporting tools, provide the findings and results of
assessing the implementation of the controls identified in the security and privacy plans to
determine the extent to which the controls are implemented correctly, operating as intended,
and producing the desired outcome with respect to meeting security and privacy requirements.
The assessment reports may contain recommended corrective actions for deficiencies identified
in the controls.133 The authorizing official reviews the reports and determines the appropriate
risk response [Task R-3].
Supporting the near real-time risk management objectives of the authorization process, the
assessment reports are updated on an ongoing basis whenever changes are made to the
controls implemented within or inherited by the system.134 Updates to the assessment reports
131 [SP 800-53A] provides guidance on security assessment reports. Guidance on privacy assessment reports will be
addressed in future publications.
132 The information system security plan and the privacy plan may be integrated into one consolidated document.
133 An executive summary provides an authorizing official with an abbreviated version of the security and privacy
assessment reports focusing on the highlights of the assessment, synopsis of findings, and recommendations for
addressing deficiencies in the security and privacy controls.
134 Because the desired outcome of ongoing tracking and response to assessment findings to facilitate risk
management decisions is the focus (rather than the specific process used), organizations can manage and update
security assessment report information using any format or method consistent with internal organizational processes.