What establish the scope of protection for organizational information systems?

• A. System Boundaries
• B. Access Control
• C. Data Flow
• D. Incident Response

Answer: (A)

System boundaries establish the scope of protection for organizational information systems. They delineate what assets, components, and data are inside the protected environment and what lies outside, guiding which security controls, policies, and monitoring apply. Once the boundary is defined, you know exactly what needs protection, what interfaces exist, and what risks to assess or mitigate. Access control, data flow, and incident response are essential security activities, but they operate within that defined boundary rather than setting the scope itself: access control enforces who can reach resources inside the boundary, data flow describes how information moves within or across boundaries, and incident response deals with events that occur within or across those boundaries. Clear boundaries help ensure consistent protection, accountability, and compliance.