CGRC · Question #233
All components of an information system to be authorized for operation by an authorizing official and excludes separately authorized systems, to which the information system is connected best…
The correct answer is A. Authorization Boundary. The definition describes the precise scope of an information system that is subject to a single authorization package and decision by an authorizing official. This specific scope, which includes all managed components and excludes external systems, is known as the authorization…
Question
All components of an information system to be authorized for operation by an authorizing official and excludes separately authorized systems, to which the information system is connected best defines:
Response:
Options
- AAuthorization Boundary
- BSystem Boundary
- CNetwork Boundary
- DCreditation Boundary
How the community answered
(36 responses)- A94% (34)
- C3% (1)
- D3% (1)
Why each option
The definition describes the precise scope of an information system that is subject to a single authorization package and decision by an authorizing official. This specific scope, which includes all managed components and excludes external systems, is known as the authorization boundary.
An Authorization Boundary defines the entire scope of an information system for which a specific authorization decision is made by an authorizing official, encompassing all hardware, software, firmware, and information and excluding external, separately authorized systems. It clearly delineates what is covered by a particular authorization.
A 'System Boundary' is a broader term referring to the extent of an information system, which may or may not align directly with what an authorizing official authorizes in a single package.
A 'Network Boundary' specifically refers to the perimeter of a network, not necessarily the full scope of an information system for authorization purposes.
'Creditation Boundary' is not a standard term used in information security or authorization frameworks like NIST RMF.
Concept tested: Definition of authorization boundary
Source: https://csrc.nist.gov/glossary/term/authorization-boundary
Topics
Community Discussion
No community discussion yet for this question.