SCA stands for which term in RMF?

• A. System Compliance Audit
• B. Security Control Assessment
• C. Security Certification Authority
• D. Security Control Authorization

Answer: (B)

Security Control Assessment is the process in RMF that evaluates the security controls selected and implemented for an information system. It verifies that controls are properly implemented, operating effectively, and producing the intended security outcomes. Assessors gather evidence, perform tests, and document findings in an assessment report, highlighting weaknesses, impact, and recommended mitigations. The results feed into the authorization decision, helping the Authorizing Official determine whether the system can operate with an acceptable level of risk or if additional actions are required. Other terms like System Compliance Audit or Security Certification Authority do not align with RMF terminology, and Security Control Authorization refers to the later decision to grant authorization, not the assessment itself.