Which statement is the outcome of security categorization review and approval by senior leaders?

• A. The placement of the system within the enterprise architecture is determined.
• B. The security categorization results are documented in the security, privacy, and SCRM plans.
• C. The security categorization results are reviewed and the categorization decision is approved by senior leaders in the organization.
• D. The system is registered for purposes of management, accountability, coordination, and oversight.

Answer: (C)

Security categorization results become official once senior leaders review them and approve the categorization decision. This formal endorsement signals that the organization accepts the determined impact levels and is ready to proceed with selecting safeguards and moving into the authorization phase. The other ideas describe related activities—like where the system sits in the architecture, documenting the results, or registering the system for oversight—but they do not capture the explicit outcome of having the categorization decision reviewed and approved by leadership.