An initial remediation action was taken by the information system owner (ISO) based on findings from the security assessment report (SAR). What is the next appropriate step based on the Risk…

While documentation is important, simply adding remediation details to the security plan is not the most direct or appropriate next step for formally updating assessment findings within the RMF process.

In the NIST RMF, after remediation actions are taken based on the Security Assessment Report (SAR) findings, these actions and their outcomes should be officially documented. Including them as an addendum to the SAR or updating the SAR itself ensures that the assessment documentation remains current and reflects the system's actual security posture post-remediation, which is crucial for subsequent authorization decisions.

The ISSO plays a role, but the primary action described is the documentation of the remediation in the context of the SAR, which is a formal record, not just internal communication.

Sending for review to the ISSO is part of the process, but the formal documentation of the remediation as an addendum to the SAR is the specific record-keeping outcome needed.