Common control providers have the responsibility for development, implementation, assessment, and monitoring of common controls. In which document do common control providers document common controls?

A Plan of Action and Milestones (POA&M) tracks and reports the remediation of security weaknesses, not the documentation of common controls themselves.

NIST guidance, particularly SP 800-18, specifies that common controls, including their description, implementation details, assessment results, and monitoring strategies, are documented within the System Security and Privacy Plan of the system or organization providing them. This plan serves as a comprehensive record of the security posture.

A Security Assessment Report (SAR) documents the findings of an assessment, including vulnerabilities, but it is not the primary document for defining common controls.

A Security Authorization Plan (SAP) outlines the scope and methodology for a security assessment and authorization, but it does not serve as the primary documentation for common controls.