Which outcome corresponds to completing or updating a system-level risk assessment?

• A. The system is registered for purposes of management, accountability, coordination, and oversight.
• B. A system-level risk assessment is completed or an existing risk assessment is updated.
• C. Security and privacy requirements are defined and prioritized.
• D. The placement of the system within the enterprise architecture is determined.

Answer: (B)

Understanding when a system-level risk assessment is considered complete or up-to-date centers on the purpose of the assessment itself. When you finish a system-level risk assessment, you produce a formal record of the identified risks, their potential impacts, their likelihood, and the resulting residual risk. If changes occur—new threats, updated system configurations, or evolving controls—you update that record to keep the risk posture current. This documented completion or update is the explicit artifact produced by the risk-assessment process and is what other steps (like selecting controls and authorizing the system) rely on.

The other options describe different activities: registering the system for governance relates to accountability and oversight, defining and prioritizing security and privacy requirements happens earlier in planning, and determining where the system fits in the enterprise architecture is about architectural placement. None of those are the direct outcome of performing or updating a system-level risk assessment in the way that completing or updating the risk assessment is.