Which item is included in an Authorization Package?

• A. System Security Plan
• B. Risk Acceptance
• C. Security Controls Baseline
• D. Incident Response Plan

Answer: (A)

When an authorization decision is made, the package of documents used to support that decision is assembled. The System Security Plan is included because it provides the formal description of the system, its boundaries, the security controls in place, responsibilities, and how those controls are implemented and assessed. This plan serves as the primary reference for what needs protection and how security is managed, making it a core component of the Authorization Package. The other items listed are important in security governance or as parts of the overall program, but they are not the artifact routinely identified as the item included in the package itself.