A security manager has started a new job and has identified that a key application for a new client does not have an accreditation status and is currently not meeting the compliance requirement for…

Reviewing the previous accreditation's system description, even if incomplete, still provides a partial baseline reference, making it less risky than relying on an entirely unreviewed traceability matrix.

The Security Requirements Traceability Matrix maps security requirements to system components and controls; relying on a prior SRTM without verifying the current system means the assessment is grounded in data that may be invalid if the system has been modified, upgraded, or reconfigured since the last accreditation. This flaw propagates through the entire assessment, potentially leaving real vulnerabilities unidentified and producing a risk determination that does not reflect the actual environment.

Hiring an administrator from the previous contract leverages institutional knowledge about the system's history and configuration, which reduces assessment risk rather than increasing it.

Skipping the vendor interview omits one input into the system description but does not invalidate the entire analytical framework the way an unreviewed SRTM does.