Which statement describes that security categorization results reflect the organization's risk management strategy?

• A. The information life cycle is identified.
• B. Security categorization results reflect the organization's risk management strategy.
• C. The system is registered for purposes of management, accountability, coordination, and oversight.
• D. Security categorization results are consistent with the enterprise architecture and commitment to protecting the organizational missions, business functions, and mission/business processes.

Answer: (B)

Security categorization is about assigning protection levels based on how impact would affect the organization’s operations, assets, and individuals. When the results reflect the organization’s risk management strategy, it means the chosen impact levels and the protection posture are driven by how the organization tolerates and mitigates risk for its missions and business processes. This alignment ensures that the safeguards put in place match the level of risk the organization is willing to accept and the criticality of the system to mission success.

The other statements shift focus to different areas: identifying how data flows through its life cycle, establishing governance and accountability for the system, or aligning with enterprise architecture and protecting missions—these are related concerns, but they don’t state the direct link between categorization outcomes and the organization’s risk management approach as clearly.