The relationship between the SSP and RAR is cyclical. A finding in the RAR often necessitates a change in the SSP—either by implementing a new control or modifying an existing one to mitigate a newly discovered risk.
In the world of high-stakes cybersecurity compliance, specifically within the , two documents serve as the bedrock of system authorization: the System Security Plan (SSP) and the Risk Assessment Report (RAR) . Ssp rar
It details the specific security controls—such as encryption, access logs, and physical barriers—that are "in place" or "planned." The relationship between the SSP and RAR is cyclical
If the SSP is the plan, the is the audit. The RAR evaluates the effectiveness of the controls listed in the SSP against actual threats. It identifies vulnerabilities, assesses the likelihood of exploitation, and determines the potential impact on the mission. assesses the likelihood of exploitation