Which statement best describes the purpose of a System Security Plan (SSP) in Annex F?

• A. System description, architecture, boundary, roles, controls, procedures, and assessment results.
• B. Personal employee records.
• C. Marketing plan.
• D. Financial statements.

Answer: (A)

The main idea being tested is that a System Security Plan is the formal document that lays out how a system is secured. It describes what the system is, its architecture and boundary, who has roles and responsibilities, which security controls are in place, the procedures for operating and protecting the system, and the results of security assessments. This single plan ties together the system’s design, security measures, how those measures are implemented in practice, and how they are evaluated over time to show compliance and manage risk. It isn’t about personal employee records, marketing plans, or financial statements, which serve unrelated purposes.