Which outcome involves identifying, documenting, and publishing common controls that can be inherited by organizational systems?

• A. The organization-wide risk assessment is updated.
• B. The types of information processed, stored, and transmitted by the system are identified.
• C. Common controls that are available for inheritance by organizational systems are identified, documented, and published.
• D. The authorization boundary is determined.

Answer: (C)

Common controls are security measures that the organization implements at an organizational level and that can be inherited by individual systems. The outcome described focuses on identifying which of these controls exist, documenting them in a central catalog, and publishing them so system owners can rely on them during authorization. This reuse is powerful because it promotes consistency across many systems, reduces duplication of effort, and makes the assessment process more efficient since multiple systems can inherit the same set of controls rather than each building their own. Publishing the catalog ensures transparency and governability, so that when a system boundary is defined, the inherited controls are clearly identified and auditable. Other activities like updating risk assessments, identifying data processed by a system, or determining the authorization boundary do not specifically address the identification, documentation, and publication of common controls for inheritance.