Which outcome determines the authorization boundary (the system) for the risk-management context?

• A. The authorization boundary (i.e., system) is determined.
• B. The types of information are identified.
• C. Common controls are published.
• D. The mission is identified.

Answer: (A)

Defining the scope of what’s being authorized—the authorization boundary—is the key idea. The boundary is the line that separates what is inside the information system under authorization from what is outside. This boundary is set by deciding which hardware, software, networks, and data are part of the system for risk-management purposes. Once that boundary is established, you’ve defined the system itself and the controls that apply inside it. Other steps like identifying the types of information, publishing common controls, or identifying the mission shape risk management practices, but they don’t by themselves establish the scope of the authorization.