Which outcome identifies missions, business functions, and mission/business processes that the system is intended to support?

• A. The stakeholders having an interest in the system are identified.
• B. Missions, business functions, and mission/business processes that the system is intended to support are identified.
• C. The types of information processed by the system are identified.
• D. The authorization boundary (system) is determined.

Answer: (B)

Understanding the system in its real-world role is the key here. Identifying the missions, business functions, and the mission/business processes the system is meant to support sets the context and scope for everything that follows in risk management. When you know exactly what the system is supposed to help the organization accomplish, you can determine what needs protection, who relies on it, and how it fits into the larger operations. This context guides security categorization, the selection of appropriate controls, and how the authorization boundary is drawn, ensuring safeguards are aligned with actual responsibilities and workflows.

While recognizing who has an interest in the system, or what types of information it handles, or where the boundary should lie are all important steps, they come after you’ve clarified the system’s purpose and the business processes it supports.