ISC2 Governance, Risk and Compliance (CGRC) Practice Question

The primary purpose of an authorization boundary is to identify every component that stores, processes, or transmits the system's information so that assessors and authorizing officials know precisely what must be protected and evaluated. Listing all hardware, software, and network interfaces establishes the scope of the security assessment and control implementation. Although data-retention schedules, privileged-user lists, and overarching privacy policies are important artifacts within a complete System Security Plan, they do not by themselves establish where the system begins and ends or what resources are subject to control selection. Therefore, specifying all system components and interconnections is the most critical detail for the authorization boundary.