What is the main consideration in determining the scope of protection for an information system?

• A. System Categorization
• B. System Boundaries
• C. Risk Assessment
• D. Data Classification

Answer: (A)

The main concept is that the extent of protection you must provide to an information system is determined by how critical the system and its data are. This is assessed through system categorization, which assigns a security category (low, moderate, or high) based on the potential impact to operations, assets, and individuals if confidentiality, integrity, or availability are compromised. That categorization sets the required level of protection and, importantly, defines what components, interfaces, and data are in scope for protection efforts. In other words, knowing the impact level tells you how robust the controls must be and what parts of the system need protection, which establishes the scope.

Data classification helps label data by sensitivity and feeds into the categorization process, but it’s the overall system categorization that determines the protection scope. Risk assessment influences prioritization and resource allocation but doesn’t by itself establish the boundary of what is protected. System boundaries matter for what is included, but they are defined in light of the protection requirements determined through categorization.