The security authorization package contains multiple key documents enabling the authorization officials to make risk based authorization decisions. Which of the following documents is not part of…

The security plan describes the security controls for the system and is a fundamental component of the authorization package.

The security assessment report details the findings from the security control assessment and is critical for informing the authorization decision.

The Plan of Action and Milestones (POAM) identifies and tracks the remediation of security weaknesses and is a vital document for managing residual risk within the authorization process.

Security Service Level Agreements (SLAs) are contracts or agreements that define the level of service expected from a service provider, including security-related metrics. While important for operational security, SLAs are generally not a mandatory part of the formal security authorization package submitted to an authorizing official for a risk-based decision.