In RMF, what does the authorization boundary define?

• A. The boundary determined by the firewall's external IP.
• B. The scope of the system's authorization boundary including interfaces and data flows.
• C. The physical perimeter of the building.
• D. The boundary of the budget.

Answer: (B)

The authorization boundary is the scope of what is protected and assessed in the system’s security authorization. It defines which components, interfaces, and data flows are inside the system’s control and therefore covered by the security controls and the authorization decision. This boundary, usually documented in the System Security Plan, determines what is in scope for risk assessments, control selections, and the eventual Authorization to Operate.

That makes the best answer the one that describes the boundary as the scope of the system’s authorization, including interfaces and data flows. It isn’t defined by a firewall’s external IP, it isn’t the physical building perimeter, and it isn’t the budget.