Information developed from Federal Information Processing Standard (FIPS) 199 may be used as an input to which authorization package document? Response:

The Security Assessment Report (SAR) documents the results of the security control assessment, which happens after the SSP is developed.

FIPS 199 defines the security categorization of information systems (low, moderate, high for confidentiality, integrity, availability). This categorization directly informs the selection and implementation of security controls documented in the System Security Plan (SSP), which is a core document in the authorization package. The SSP details the system boundaries, operational environment, and the security controls in place or planned.

The Plan of Actions and Milestones (POA&M) tracks weaknesses and deficiencies, which are identified after security controls are assessed, making it a subsequent document.

The Authorization Decision Document is the final document issued by the Authorizing Official, which comes after the SSP and SAR are completed and reviewed.