CGRC Practice Question: Is an example of a 'System Boundary' document that assists with the RMF process?
Which of the following is an example of a 'System Boundary' document that assists with the RMF process?
⚠ Common exam trap
CGRC often tests the confusion between RMF artifacts — candidates must distinguish the SSP (which contains the boundary description) from privacy documents like the PTA and governance documents like SDLC policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The System Security Plan (SSP) boundary description.
The System Security Plan (SSP) is the RMF artifact that documents the system boundary — the people, processes, and technologies that make up the system and its authorization boundary. The boundary description within the SSP defines what is inside versus outside the authorization, which directly supports categorization, control selection, and assessment scoping in the RMF process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The System Security Plan (SSP) boundary description.
Why this is correct
The SSP's boundary description explicitly documents the authorisation boundary — the people, processes, and information systems comprising the system — which directly satisfies the RMF requirement for a defined System Boundary artefact used during categorisation and control scoping.
- ✗
The Annual Security Awareness Training log.
Why it's wrong here
A training log evidences that personnel completed awareness requirements; it records compliance activity, not the components, interfaces and assets inside an authorisation boundary. It would be correct if the question asked for evidence supporting the RMF awareness and training control.
- ✗
The Privacy Threshold Analysis (PTA).
Why it's wrong here
A Privacy Threshold Analysis determines whether a privacy impact assessment is required, addressing personally identifiable information handling rather than system scope. It would be correct if the question asked which document screens systems for privacy review under the RMF.
- ✗
The System Development Life Cycle (SDLC) policy.
Why it's wrong here
An SDLC policy governs how systems are developed and maintained organisation-wide, not which components sit inside a given authorisation boundary. It would be the right artefact when the question asks for the process governing system lifecycle phases during RMF implementation.
About these practice questions
One of 341 original CGRC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- An Information System Owner (ISO) is deciding whether to include a legacy database within a new application's authorizat…
- A system owner is defining the authorization boundary for a new information system that will process personally identifi…
- Which document is mandatory to finalize the system categorization and begin the RMF process?
- A program manager is preparing documentation for a new system and needs to describe the system boundary. Which artifact…
- A federal agency is defining the authorization boundary for a new system that will process controlled unclassified infor…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.