Assessment findings are documented in which report?

• A. System Assessment Report (SAR)
• B. Annual Security Review
• C. Operational Readiness Document
• D. Audit Log Summary

Answer: (A)

The results of a security evaluation are captured in a System Assessment Report. This document consolidates what was tested, what vulnerabilities or control gaps were found, the associated risk levels, and recommended mitigations. It provides an official record for managers and authorizing officials to understand the system’s security posture and decide on appropriate actions. The other options serve different purposes: an annual security review sums up program performance over a year, an operational readiness document focuses on preparing systems for operation, and an audit log summary is a record of events and activities, not a formal assessment of controls. So, the assessment findings belong in the System Assessment Report.