Scope of the System
The boundary is the foundation of everything downstream
Scoping defines the authorization boundary: the people, processes, technology, facilities, and data the authorization decision covers. Everything inside must be identified - hardware, software, firmware, interfaces, interconnections, and the information types processed, stored, or transmitted. Then categorize with FIPS 199: confidentiality, integrity, and availability each rated low, moderate, or high by the potential impact of loss, using SP 800-60 information types as the starting dictionary. Privacy impact is assessed separately, not as a fourth FIPS 199 letter.
The boundary also determines inheritance. Controls provided by a common control provider or by another authorized system can be inherited, which reduces work but never transfers accountability. Interconnections documented through agreements must be identified and their risk accepted.
Traps
A network diagram is not a boundary; questions often show a diagram and expect you to notice a component sitting outside the drawn box. Inheritance is not a free pass - the system owner must verify inherited controls are actually in place. Categorization is driven by the highest potential impact across all information types, so one sensitive data set can raise the whole system. A boundary change (new data type, new interconnection, migration to cloud) is a scoping event that may trigger re-categorization.
Rule of thumb
Draw the box, then list every asset that stores, processes, transmits, or protects the data. If you cannot name it, you cannot categorize it; if you cannot categorize it, you cannot scope it.