Which outcome ensures identification of missions, business functions, and the processes the system is intended to support?

• A. Missions, business functions, and mission/business processes identified.
• B. The stakeholders having an interest in the system are identified.
• C. The types of information identified.
• D. The authorization boundary is determined.

Answer: (A)

Mapping the system to its missions and the business processes it is meant to support establishes the scope and purpose of the system. When you identify the missions, the business functions, and the mission/business processes, you create a concrete understanding of what the system must enable and how activities flow through it. This foundation guides the selection of security controls, defines the system boundary, and ensures protection and compliance align with real operations. Other aspects like who has a stake, what types of information exist, and where the authorization boundary lies are important pieces, but they don’t by themselves specify which missions and processes the system must support. By capturing these elements, you ensure subsequent RMF steps target the actual functions the system is intended to perform.