Which outcome pertains to conducting a prioritization of organizational systems with the same impact level?

• A. The mission/business processes are identified.
• B. The types of information processed, stored, and transmitted by the system are identified.
• C. An organization-wide risk assessment is completed or updated.
• D. A prioritization of organizational systems with the same impact level is conducted.

Answer: (D)

When several organizational systems share the same impact level, the key step is deciding which of those systems to address first. This prioritization ensures that limited resources—like time, personnel, and controls—are deployed in a deliberate order that reflects the organization’s risk posture. Even with equal impact levels, some systems may be more critical to mission operations, have greater interdependencies, or pose higher aggregate risk if compromised, so ranking them clarifies the sequence for applying security measures and mitigations.

The other tasks describe important activities, but they don’t capture the need to order efforts among systems that share the same impact level. Identifying mission or business processes focuses on what must be supported, not how to sequence protection. Similarly, identifying the types of information processed or stored relates to data characteristics, and a broad organization-wide risk assessment gives a wide view of risk but not the specific prioritization among equal-impact systems.