Risks that reside in the <System Name> that cannot be corrected because of operational impact to the system are summarized in Table 53 Summary of Risks Remaining Due to Operational Requirements. An explanation of the operational impact and risks are included below as well as in the appropriate Security Assessment Test Cases and System Security Plan (SSP). Although these risks are not to be corrected, they are listed in this <System Name Acronym> SAR Appendix A: Risk Exposure Table, and tracked in the Plan of Action and Milestones (POA&M) as Operational Requirements. Instruction: 3PAO must ensure that the content of this table is consistent with the same information documented in <System Name Acronym> SAR Appendix A: Risk Exposure Table. Delete this instruction from your final version of this document. Note: The justification that remediating a vulnerability will cause a break in functionality is not a sufficient rationale for permitting the risk to persist. There must also be full descriptions of the mitigating factors and compensating controls that address the ongoing risk to this specific system. Table 53 Summary of Risks Remaining Due to Operational Requirements Identifier Description Source of Discovery Current Risk Exposure Operational Requirements Rationale and Mitigating Factors
Risks that reside in the <System Name> that cannot be corrected because of operational impact to the system are summarized in Table 53 Summary of Risks Remaining Due to Operational Requirements. An explanation of the operational impact and risks are included below as well as in the appropriate Security Assessment Test Cases and System Security Plan (SSP). Although these risks are not to be corrected, they are listed in this <System Name Acronym> SAR Appendix A: Risk Exposure Table, and tracked in the Plan of Action and Milestones (POA&M) as Operational Requirements. Instruction: 3PAO must ensure that the content of this table is consistent with the same information documented in <System Name Acronym> SAR Appendix A: Risk Exposure Table. Delete this instruction from your final version of this document. Note: The justification that remediating a vulnerability will cause a break in functionality is not a sufficient rationale for permitting the risk to persist. There must also be full descriptions of the mitigating factors and compensating controls that address the ongoing risk to this specific system. Table 53 Summary of Risks Remaining Due to Operational Requirements Identifier Description Source of Discovery Current Risk Exposure Operational Requirements Rationale and Mitigating Factors
FedRAMP-SAR-Template.docx