Which statement correctly describes the Authorization Boundary?

• A. All components to be authorized for operation by an authorizing official; excludes separately authorized systems to which the information system is connected.
• B. Only the network edge of the system.
• C. Only the data storage components.
• D. Only the user interface components.

Answer: (A)

The Authorization Boundary defines the set of components that are within scope for security authorization. It includes all components that must be authorized for operation by an authorizing official—everything under the organization's control that contributes to the system’s security and operation. Systems that are connected but have their own separate authorization are outside this boundary. This distinction is crucial because it determines what is reviewed, how risks are assessed, and where responsibility lies for securing interfaces with external entities. The other options focus on only a single part of the system (network edge, data storage, or user interfaces), which misses the broader range of components that can affect overall security.