What should the System Security Plan (SSP) include to satisfy Annex F requirements?

• A. Only hardware inventories
• B. Governing policies
• C. Defined responsibilities, accountability, escalation paths, and implemented controls
• D. Marketing materials

Answer: (C)

The main thing to include is a clear mapping of who is responsible for security activities, who is accountable for those activities, how security issues are escalated, and exactly which security controls are in place and how they are implemented. This combination shows, in concrete terms, who does what, who answers for the security outcome, the steps for raising and handling problems, and the actual controls that protect the system. Hardware inventories alone don’t establish roles or controls, and governing policies alone don’t demonstrate how those policies are put into action or who enforces them. Marketing materials are irrelevant to the security plan.