Periodically assess security controls and develop plans of action.
Security assessment holds the system security plan and the plan of action, the two documents every other family reports into, plus periodic self-assessment and continuous monitoring. The plan itself is not scored, because without it an assessment cannot proceed at all.
