Which description best defines the security authorization boundary?

• A. It defines the system's password policy.
• B. It is a legal boundary between organizations.
• C. It is the boundary around which firewalls are configured.
• D. It is a defined scope within which security controls are implemented and risk is managed.

Answer: (D)

The security authorization boundary is the defined scope of a system that is subject to security controls and risk management as part of the authorization process. Within this boundary, all components, data, and interfaces are evaluated, and the applicable security controls are implemented and assessed to determine whether the system can operate safely. This boundary helps determine what is in scope for testing, monitoring, and the authorizing official’s decision.

It’s not about a password policy, which is a specific control related to authentication; it’s not a legal boundary between organizations, which concerns governance rather than the technical scope of security controls; and it’s not simply the boundary where firewalls sit, which is more about network separation than the formal authorization scope.