Which outcome states that control baselines necessary to protect the system commensurate with risk are selected?

• A. The placement of the system within the enterprise architecture is determined.
• B. Security and privacy requirements are defined and prioritized.
• C. Control baselines necessary to protect the system commensurate with risk are selected.
• D. The system is registered for purposes of management, accountability, coordination, and oversight.

Answer: (C)

Selecting control baselines that protect the system in line with its risk level is about choosing a set of security controls that matches the system’s risk. In this approach, baselines provide a starting point and are tailored to the specific risk profile so the protections are commensurate with the potential impact. That description directly captures the action of choosing the appropriate baseline controls based on risk.

The other descriptions refer to different parts of the process—where the system fits in the enterprise architecture, defining and prioritizing security and privacy requirements, or registering the system for management and oversight—which are separate steps and do not describe the actual baseline selection.