FedRAMP Rev 5 P.7: P.7 Security assessment report

The SAR, developed by the 3PAO on the FedRAMP template with Appendix A the risk exposure table, B the security requirements traceability matrix workbook, C vulnerability scan results, D documentation review findings, E auxiliary documents, F the penetration test report and the evidence collected, documents the results and the risks remaining; every other than satisfied result in the traceability matrix appears as an open risk in the risk exposure table unless corrected during testing and recorded on the risks-corrected tab, mitigating factors for risk adjustments and the rationale and mitigations for operational requirements are described adequately because AOs scrutinize them, the executive summary matches the table, and the 3PAO attests to the accuracy of the SAR and gives an authorization recommendation; the provider reviews the final SAR for quality before it goes to the AO.