A security manager has started a new job and has identified that a key application for a new client does not have an accreditation status and is currently not meeting the compliance requirement for…

Reviewing a previous system description provides a useful historical baseline, which reduces rather than maximizes risk compared to using entirely unreviewed artifacts.

Using a previous Security Requirements Traceability Matrix (SRTM) without reviewing the current system introduces the highest risk because system components, configurations, and threats may have changed since the prior accreditation. The SRTM maps security requirements to controls, and if the current system differs from the documented state, critical coverage gaps will be missed entirely. Proceeding with an assessment based on stale traceability data undermines the integrity of the entire risk assessment and could result in accepting unknown residual risks.

Hiring an administrator with firsthand knowledge of the previous contract can improve accuracy and reduce risk by leveraging institutional knowledge of the system's history.

Not interviewing the vendor is a gap in due diligence but is less risky than proceeding with an unreviewed SRTM that may be entirely outdated and inapplicable.