Which statement accurately differentiates a minor application from a major application?

• A. A minor application is typically included as part of a general support system; a major application requires separate security attention due to higher risk.
• B. A minor application handles more users than a major one.
• C. A minor application is always hosted on-premises.
• D. A minor application has greater uptime requirements.

Answer: (A)

Security attention and risk level determine whether an application is minor or major. Minor applications sit within the general support system, so they fall under the broader security controls and governance that cover day-to-day operations. Major applications, however, carry higher risk or have greater impact, and therefore require separate security attention, with dedicated assessment and authorization processes. The distinction isn’t about how many users a system supports, where it’s hosted, or uptime requirements—those are separate considerations. This framing explains why a minor app is typically part of the general support system while a major app demands its own security focus due to the higher risk.