Which outcome requires categorization results to be documented in the security, privacy, and SCRM plans?

• A. The placement of the system within the enterprise architecture is determined.
• B. The system is registered for purposes of management, accountability, coordination, and oversight.
• C. The characteristics of the system are described and documented.
• D. The security categorization results are documented in the security, privacy, and SCRM plans.

Answer: (D)

Categorization results identify the level of protection required for the system (low, moderate, or high) across confidentiality, integrity, and availability. Recording these results in the security, privacy, and SCRM plans ensures that the planned protections, privacy safeguards, and supply chain considerations are aligned with the actual risk posture. This creates a clear, traceable basis for selecting controls and for ongoing monitoring, and it helps stakeholders understand why certain requirements and safeguards are in place. The other statements describe different aspects of system context or governance, not the act of documenting categorization outcomes in the planning documents.