Which outcome describes that an organization-wide risk assessment is completed or an existing risk assessment is updated?

• A. An organization-wide risk assessment is completed or an existing risk assessment is updated.
• B. Common controls identified, documented, and published for inheritance.
• C. The authorization boundary is determined.
• D. The types of information processed, stored, and transmitted by the system are identified.

Answer: (A)

In RMF practice, the starting phase centers on establishing a current view of risk across the organization. Completing an organization-wide risk assessment or updating an existing one creates the baseline you need to understand overall risk, guide control selection, and set the scope for authorization. That exact outcome is what the initial Prepare step aims to achieve, making it the best fit.

The other statements describe outcomes from later activities: identifying common controls for inheritance relates to selecting controls; determining the authorization boundary concerns scoping what’s inside the authorization; and identifying the types of information processed to inform security categorization.