Which statement is an outcome of security categorization?

• A. The system is registered for purposes of management, accountability, coordination, and oversight.
• B. A security categorization of the system, including the information processed by the system represented by the organization-identified information types, is completed.
• C. The placement of the system within the enterprise architecture is determined.
• D. Control baselines necessary to protect the system are selected.

Answer: (B)

Security categorization results in a formal determination of how the system and the information it processes are safeguarded, by identifying the information types and assigning impact levels for confidentiality, integrity, and availability. The key outcome is that the security categorization of the system, reflecting the organization-identified information types, is completed. This creates the formal basis for how stringent the protections need to be and directly informs later steps like selecting and tailoring the control set. The other items describe results from different RMF steps: governance and oversight considerations, how the system fits into the broader architecture, and the selection of control baselines after categorization, respectively.