ISC2 Governance, Risk and Compliance (CGRC) Practice Question

An authorization boundary must encompass every component that processes, stores, transmits, or displays the system's information, without regard to who owns the asset or where it is located. NIST guidance on system security planning and risk management (e.g., SP 800-18 Rev. 1 and SP 800-37 Rev. 2) states that the boundary is determined by information flow and control, not by organizational ownership, physical placement, or previous accreditation scope. Excluding cloud services, re-using outdated component lists, or omitting user devices solely because they use encrypted connections would leave portions of the information system unmanaged and unprotected, defeating the purpose of boundary definition. Therefore, the comprehensive inclusion of all components that handle payroll data-whether on-premises or in a SaaS environment-is required.