A Security Assessment Plan (SAP) outlines an organization’s approach to meeting all applicable security controls as required by the Federal Risk and Authorization Management Program (FedRAMP). It typically includes details such as an overview of the organization’s existing security measures, proposed changes or additions to ensure compliance with FedRAMP requirements, and a timeline for implementation. The SAP must be reviewed and approved by the Joint Authorization Board (JAB) prior to undergoing assessment.