a site-specific security assessment determines:

The security assessment report or SAR is one of the three key required documents for a system or common control set authorization package. A penetration testing method used to collect information. …