Which outcome focuses on identifying, documenting, and publishing common controls available for inheritance by organizational systems?

• A. The organization-wide risk assessment is updated.
• B. The types of information processed, stored, and transmitted by the system are identified.
• C. Common controls that are available for inheritance by organizational systems are identified, documented, and published.
• D. The authorization boundary is determined.

Answer: (C)

Understanding how controls are managed across an organization is the heart of this concept. Common controls are security measures established at the organizational level that can be inherited by multiple systems within the organization. The key idea is to identify which controls exist, document them clearly, and publish them so that any system can reuse them without duplicating effort. This approach promotes consistency in security posture, reduces redundant work for individual systems, and provides a clear baseline for authorization processes.

So, the best choice focuses on recognizing these organizational controls, recording them, and making them available for inheritance. Publishing them ensures system owners and assessors know what controls are in place and can rely on them during the authorization process.

Other options relate to different activities: updating the organization-wide risk assessment addresses overall risk posture rather than the management and sharing of common controls; identifying the types of information a system processes concerns data inventory and classification; determining the authorization boundary deals with the scope of a system rather than how common controls are identified and reused.