Independent Testing for Risk Management Framework (RMF): Assessment Test Plan (ATP)

The purpose of this document is to describe the method by which the security controls will be assessed. In addition, the test methodology, test procedures, and test tools are described to ensure consistency and repeatability of the assessment process. The execution of this plan provides the assessment results, which are used as the basis for the decision by the Authorizing Official.

An assessment of the system is a requirement of the Federal Information Security Management Act of 2002 (FISMA...