Which document in support of the authorization package contains the well-defined set of security controls for an information system? Response:

An Initial Risk Assessment identifies potential risks and vulnerabilities but does not define the comprehensive set of implemented security controls.

The System Security Plan (SSP) is a foundational document within the authorization package that comprehensively describes the security controls chosen and implemented for an information system. It outlines how the system meets specific security requirements, detailing the technical, management, and operational controls to protect the system and its data.

Security and Privacy assessment reports document the results of security control evaluations, not the plan of controls themselves.

A Plan of Action and Milestones (POA&M) outlines tasks and deadlines for addressing identified security weaknesses, not the complete set of operational controls.