What is a System Security Plan?

• A. It outlines the organization's overall mission and strategic goals.
• B. It provides an overview of the system's security requirements and describes the controls in place or planned, responsibilities and expected behavior of all individuals who access the system.
• C. It lists all hardware assets owned by the agency.
• D. It is used solely for budget approvals.

Answer: (B)

A System Security Plan is the formal blueprint that describes how a system meets security requirements and how those protections are implemented. It lays out the security controls in place or planned, who is responsible for implementing and enforcing them, and the expected behavior of everyone who accesses the system. This document supports authorization to operate and ongoing monitoring, serving as a central reference for security governance. It isn’t about the organization’s mission or strategic goals, nor is it simply an asset inventory or a tool used only for budget approvals.