What is the purpose of a boundary diagram or system diagram in RMF?

• A. To illustrate the scope, interfaces, and data flows within the authorization boundary.
• B. To show color scheme.
• C. To track project timelines.
• D. To list users.

Answer: (A)

The boundary diagram or system diagram in RMF is used to map out what is included in the system and where it ends—the authorization boundary. It shows the scope of the system, the interfaces to other systems or components, and how data flows across those boundaries. This visualization helps determine what needs protection, which security controls apply, and how information moves between trusted and untrusted zones. It also highlights external connections and dependencies that could introduce risk, guiding proper risk assessment and control selection.

Color schemes, project timelines, or lists of users aren’t about defining what’s inside the authorization boundary or how data travels between components, so they don’t serve the purpose of a boundary diagram.