5.7 Security Assessment Report (SAR) & Risk Findings Analysis

5.7 Security Assessment Report (SAR) & Risk Findings Analysis

The ultimate deliverable of RMF Step 4 (Assess) is the Security Assessment Report (SAR) (or Privacy Assessment Report [PAR]). The SAR consolidates the findings of the independent assessment team, provides an objective evaluation of control effectiveness, calculates contextual residual risk, and provides concrete recommendations.

Along with the System Security Plan (SSP) and the Plan of Action and Milestones (POA&M), the SAR forms the tripartite Security Authorization Package submitted to the Authorizing Official (AO) in RMF Step 5 (Authorize).

---

Analyzing Assessment Evidence: Satisfied vs. Other Than Satisfied

NIST SP 800-53A establishes a binary determination model for each assessed control objective:

┌─────────────────────────────────────────────────────────────────────────────┐
│                     CONTROL EFFECTIVENESS DETERMINATION                     │
│                                                                             │
│  ┌─────────────────────────────────┐   ┌─────────────────────────────────┐  │
│  │            SATISFIED            │   │      OTHER THAN SATISFIED       │  │
│  │ • Control implemented correctly │   │ • Control missing or incomplete │  │
│  │ • Operating as intended         │   │ • Misconfigured or failing      │  │
│  │ • Produces expected outcome     │   │ • Lacks verifiable evidence     │  │
│  │ • Corroborated across evidence  │   │ • Constitutes a formal DEFICIENCY│  │
│  └─────────────────────────────────┘   └─────────────────────────────────┘  │
└─────────────────────────────────────────────────────────────────────────────┘

1. Satisfied

• Criteria: The assessment evidence demonstrates that the control or control enhancement is implemented exactly as specified in the SSP, complies with NIST SP 800-53 baselines, operates reliably across all operational scenarios, and produces the desired security outcome.
• Action: No deficiency recorded; control is marked compliant.

2. Other Than Satisfied (Finding / Deficiency)

• Criteria: The assessment reveals that the control is not implemented, partially implemented, misconfigured, failing to operate as intended, bypassed by operational workarounds, or lacks sufficient verifiable evidence.
• Action: The assessor must document a formal Finding (Deficiency) in the SAR detailing the exact control gap, affected system components, potential threat exploits, likelihood, impact, and remediation recommendations.

---

Risk Findings Analysis and Scoring (NIST SP 800-30 Rev. 1)

A critical responsibility of the Security Control Assessor is contextualizing technical deficiencies into organizational risk. A raw technical vulnerability does not automatically equate to high organizational risk without considering threat exposure and mitigating factors.

┌─────────────────────────────────────────────────────────────────────────────┐
│                      RISK LEVEL DETERMINATION MATRIX                        │
│                                                                             │
│   LIKELIHOOD  ▲                                                             │
│   Very High   │    Low       Moderate        High          VERY HIGH        │
│   High        │    Low       Moderate        High          HIGH             │
│   Moderate    │    Low       Moderate        Moderate      HIGH             │
│   Low         │    Very Low  Low             Moderate      MODERATE         │
│   Very Low    │    Very Low  Very Low        Low           LOW              │
│               └──────────────────────────────────────────────────────────►  │
│                    Very Low    Low           Moderate      High / Very High │
│                                     IMPACT                                  │
└─────────────────────────────────────────────────────────────────────────────┘

The Risk Formulation Chain

Risk is assessed by evaluating the interplay between four core factors per NIST SP 800-30 Rev. 1: $\mathbf{Risk} = f(\text{Threat Likelihood}, \text{Impact Magnitude})$

1. Threat Event & Source: Identify the threat actor (adversarial cybercriminal, insider, system fault, natural disaster) capable of targeting the deficiency.
2. Vulnerability & Predisposing Conditions: The specific technical flaw (e.g., missing CVE patch) or operational circumstance (e.g., system hosted in an unmonitored server room) that facilitates exploitation.
3. Likelihood of Occurrence: Evaluated based on:
   • Threat Initiation / Capability: Adversary skill, motivation, and resource level.
   • Vulnerability Exploitability & Visibility: Ease of discovery and execution.
   • Existing Mitigations: Effectiveness of defense-in-depth safeguards.
   • Qualitative ratings: Very Low, Low, Moderate, High, Very High.
4. Magnitude of Impact: Evaluated based on the adverse consequence to organizational operations, mission capabilities, assets, individuals, or the Nation if the confidentiality, integrity, or availability (CIA) of the system is compromised:
   • Qualitative ratings: Very Low, Low, Moderate, High, Very High.

Raw CVSS Severity vs. Contextualized System Risk

---

Structure of the Security Assessment Report (SAR)

A compliant SAR must follow a standardized structure to enable executive review by the AO and technical remediation by the system owner.

┌─────────────────────────────────────────────────────────────────────────────┐
│                     SECURITY ASSESSMENT REPORT (SAR)                        │
│                                                                             │
│  ┌───────────────────────────────────────────────────────────────────────┐  │
│  │ 1. Executive Summary: High-level risk posture, summary table of       │  │
│  │    Satisfied vs. Other-Than-Satisfied controls, overall risk recommendation│
│  ├───────────────────────────────────────────────────────────────────────┤  │
│  │ 2. Assessment Methodology & Scope: Systems tested, tools used,        │  │
│  │    sampling criteria, assessment methods (Examine, Interview, Test)   │  │
│  ├───────────────────────────────────────────────────────────────────────┤  │
│  │ 3. Detailed Findings & Deficiencies: Per-control analysis:            │  │
│  │    • Control ID & Name (e.g., IA-2(1))   • Finding Description        │  │
│  │    • Evidence Artifact Ref                • Likelihood & Impact       │  │
│  │    • Contextual Risk Rating (High/Med)   • Assessor Recommendations   │  │
│  ├───────────────────────────────────────────────────────────────────────┤  │
│  │ 4. Initial Remediation Actions: Fixes applied during testing window   │  │
│  ├───────────────────────────────────────────────────────────────────────┤  │
│  │ 5. Assessor Independence & Sign-Off: Lead SCA signature & credentials │  │
│  └───────────────────────────────────────────────────────────────────────┘  │
└─────────────────────────────────────────────────────────────────────────────┘

Detailed Breakdown of SAR Sections

1. Executive Summary: Written specifically for the Authorizing Official (AO), Chief Information Security Officer (CISO), and Risk Executive (Function). Provides a concise, non-technical overview of the system's risk posture, highlights critical operational risks, and offers an informed recommendation regarding authorization.
2. Assessment Scope and Methodology: Documents the exact authorization boundary, testing dates, assessor credentials, scanning tools utilized (including tool version numbers and plugin feed dates), and the depth/coverage parameters applied.
3. Summary of Findings Table: An aggregated matrix categorizing control status across all NIST SP 800-53 control families (e.g., AC, AU, CM, IA, SC, SI), detailing the count of Satisfied vs. Other Than Satisfied controls.
4. Detailed Findings and Vulnerability Disclosures: Each deficiency is given an individual record detailing:
   • Control Identifier: (e.g., AC-2(3): Account Management | Inactive Accounts).
   • Deficiency Summary: Plain-language description of the operational failure.
   • Evidence Reference: Exact file names, scan output snippets, log timestamps, or interview transcripts.
   • Root Cause Analysis: Why the failure occurred (e.g., lack of automated script, insufficient staffing, lack of training).
   • Likelihood, Impact, and Risk Rating: Justified qualitative scores per NIST SP 800-30.
   • Assessor Remediation Recommendations: Concrete technical or administrative steps to resolve the finding.
5. Initial Remediation Actions (RMF Task A-6): Documents any corrective actions immediately implemented by the system engineering team during the assessment window (e.g., patching a service and passing an immediate rescan), updating the finding status accordingly before report finalization.

---

Assessor Sign-Off and Handoff to RMF Step 5

Once the SAR is finalized:

1. Lead Assessor Sign-Off: The Lead SCA signs the document, certifying that the assessment was executed independently, objectively, and in compliance with the approved SAP.
2. Delivery to System Owner (ISO / ISSO): The ISO reviews the SAR findings and immediately drafts the Plan of Action and Milestones (POA&M), defining milestones, assigned resources, and scheduled completion dates for every "Other Than Satisfied" finding.
3. Submission to Authorizing Official (AO): The complete Authorization Package (SSP, SAR, and POA&M) is formally submitted to the AO to drive the Step 5 authorization decision (ATO, ATO with Conditions, or DATO).