Which of the following is principally used to verify that Information Systems (IS) are meeting their stated security goals and objectives? Response:

A System Plan, particularly a System Security Plan (SSP), provides a comprehensive blueprint of an information system's security controls, policies, and procedures. This document details how the system will achieve its security goals and objectives, making it the foundational reference against which all security verifications and assessments are performed to ensure compliance and effectiveness.

A Requirements Traceability Matrix (RTM) maps requirements to testing and development stages, primarily used for tracking completeness rather than verifying an operational IS against its security goals.

A Risk Assessment (RA) identifies, analyzes, and evaluates potential risks, informing security decisions but not serving as the principal document for verifying goal achievement.

A Security Control Assessor is a role responsible for performing security assessments and verification, not a document or process used for verification itself.