An accreditation boundary is described as which of the following?

• A. An accreditation boundary includes all components to be accredited by an authorizing official and excludes separately accredited systems connected to the information system
• B. It defines the network perimeter for the system
• C. It specifies data retention rules
• D. It identifies personnel roles and responsibilities

Answer: (A)

The main point here is understanding what defines the scope of an authorization. An accreditation boundary sets what is included in the system under the authorizing official’s approval and what is outside of that approval. It means all components that are to be accredited are within the boundary, while systems that are connected but have their own separate accreditation are excluded from it. This clarifies which controls and assessments apply to the system as a whole. The network perimeter is related but not the same thing, and data retention rules or personnel roles belong to policy and governance, not the scope of the authorization.