Which outcome describes describing and documenting the characteristics of the system?

• A. The placement of the system within the enterprise architecture is determined.
• B. The system is registered for purposes of management, accountability, coordination, and oversight.
• C. A security categorization of the system is completed.
• D. The characteristics of the system are described and documented.

Answer: (A)

Describing and documenting the characteristics of the system is the step that establishes a clear, shared picture of what the system is, what it does, what data it processes, how it interfaces with other components, and where its boundaries lie. This detailed description provides the factual basis for everything that follows—how the system should be protected, which controls apply, and how it fits into the broader enterprise environment. Without a precise description, you can’t accurately assess risk, select appropriate security controls, or communicate scope to stakeholders.

Other outcomes—where the system sits in the enterprise architecture, ensuring it’s registered for governance and oversight, or determining its security categorization—are important, but they build on or serve different purposes. The act of describing and documenting the system’s characteristics directly captures the needed, concrete description of the system itself.