Authorization Boundary

The authorization boundary defines exactly what is included in a system's security authorization — which hardware, software, networks, people, and processes are 'inside' the boundary and subject to the system's security controls. Everything inside the boundary is covered by the ATO; everything outside is not.

Drawing the authorization boundary is a critical early step in the RMF process. It determines the scope of your security controls, your assessment, and your documentation. A well-defined boundary makes everything downstream clearer and more manageable.