Which outcome identifies the stakeholders having an interest in the system?

• A. The mission/business processes are identified.
• B. The assets are identified and prioritized.
• C. The stakeholders having an interest in the system are identified.
• D. The information types are identified.

Answer: (C)

Identifying who has an interest in the system is essential because stakeholders determine what needs protection, what constitutes acceptable risk, and who must approve security decisions. Knowing the stakeholders lets you assign roles, responsibilities, and communication channels, and it informs all subsequent security activities, including control selection and authorization. The other tasks—mapping mission or business processes, listing and ranking assets, and cataloging information types—address different facets of the system but do not identify who has an interest or authority over it. So identifying the stakeholders is the correct outcome.