Which are key components of a System Security Plan (SSP) for Annex F?

• A. System description, architecture, boundary, roles, controls, procedures, and assessment results.
• B. System description only and a list of hardware.
• C. Mission statement and marketing plan.
• D. Budget and procurement records.

Answer: (A)

The key idea here is that a System Security Plan for Annex F should present a complete view of how the system is protected and how that protection is verified. The best answer includes all the essential elements that describe the system and the security measures around it. A System Security Plan should start with a thorough system description to establish what the system is, its purpose, and its major components. It then maps out the architecture and boundary, showing how the system is structured and what lies inside or outside its perimeters, which is crucial for understanding where risks may arise and what protections are needed at interfaces.

Defining roles and responsibilities is next, so there is clear accountability for security tasks and decision-making. The plan also spells out the security controls chosen to protect the system, detailing how each control is implemented and maintained through specific procedures. Finally, assessment results provide evidence of how well the controls work, including test findings, remediation steps, and the current status of residual risk. This combination of description, structure, responsibilities, implemented controls with procedures, and ongoing assessment creates a living document that supports risk management, authorization, and continuous monitoring.

Other options fall short because they omit essential security elements, such as the actual controls, procedures, and assessment evidence, or they focus on topics unrelated to security planning like mission statements, marketing plans, budgets, or procurement records.