Which of the following is true about a Security Assessment Report (SAR)?

• A. It is produced by the system owner exclusively.
• B. It is produced by the certification agent and may include corrective actions and the completed system reporting form.
• C. It is produced as part of annual financial audit.
• D. It is only a summary of test results.

Answer: (B)

In this domain, the Security Assessment Report is the formal document produced after the security controls are evaluated. It is created by the designated certification agent or assessor, not solely by the system owner, and it presents the findings, the evidence gathered, and the assessed risk posture.

This report typically includes recommended corrective actions and may incorporate the completed System Reporting Form, tying together the assessment results with the reporting artifacts used to support authorization decisions. It’s not part of an annual financial audit, and it isn’t just a simple summary of test results; it provides a comprehensive view of which controls work, where gaps exist, and how those gaps should be addressed.

That’s why the statement describing the SAR as produced by the certification agent and potentially including corrective actions and the completed system reporting form best matches how these reports are used in practice.