An auditor asks the DBA team for the document that describes the database system's security requirements, its authorization boundary, and the security controls that are implemented or planned for it. Which disaster recovery planning document is the auditor requesting?
Select an answer to reveal the explanation.
Short Explanation
Think of the SSP as the security owner's manual for a system: what it is, where its boundary lies, and which controls protect it. The COOP keeps the mission running, and the SDD explains how the thing is built. When the question says controls and boundary, you're looking at the SSP.
Full Explanation
A system security plan documents a system's security posture: it describes the system and its authorization boundary, identifies the information it handles and its security requirements, and records the security controls that are in place or planned, along with who is responsible for them. In DataSys+ terms it is one of the disaster recovery documents because recovery teams need to rebuild systems with the same controls and boundary, and auditors use it to verify that controls exist as described. A continuity of operations plan focuses on sustaining an organization's essential functions during a significant disruption, including alternate facilities, succession and priorities; it is mission-oriented rather than a system's control inventory. A system design document describes how a system is built, its architecture, components, interfaces, data flows and configuration, which helps a recovery team rebuild it, but it is not the authoritative record of security requirements and implemented controls. A service-level agreement is a contract that sets measurable service commitments such as availability and response times between a provider and a customer, with no catalogue of security controls. Exam caveat: the three DataSys+ DR documents are SSP for security, COOP for continuity of essential functions, and SDD for design. Operational check: confirm the SSP lists the database within its boundary and that its control descriptions match current configuration.