What is an Authorization Boundary?

• A. All components of an information system to be authorized for operation by an authorizing official and excludes separately authorized systems, to which the information system is connected.
• B. The boundary between internal and external networks.
• C. The boundary around a data center room.
• D. A boundary defined by user authentication methods.

Answer: (A)

An authorization boundary defines the scope of what is officially approved to operate as part of a system. It includes all components of the information system that will be authorized for operation by the authorizing official and excludes separately authorized systems to which the information system is connected. This boundary sets the exact scope for applying security controls, conducting assessments, and ongoing monitoring, ensuring the risk decisions focus on the components within the approved boundary and their interactions.

Understanding this helps prevent overreach: even if the system connects to other systems, those connected systems can be kept in scope of their own authorization, while the boundary itself clearly marks what is included for this particular authorization. The other options describe different kinds of boundaries that aren’t about the formal scope of an authorization—network boundaries separate internal and external networks; physical boundaries around a data center relate to facility security; and boundaries defined by authentication methods pertain to access control, not the authorized scope of operation.