Information System Categorization Flashcards

A federal agency is categorizing a financial management system that processes payroll data (provisional impact: Confidentiality-Moderate, Integrity-Moderate, Availability-Low) and also hosts a public-facing information portal (provisional impact: Confidentiality-Low, Integrity-Low, Availability-Low). The two functions share the same infrastructure and cannot be separated. Following NIST SP 800-60 guidance, what is the correct system security categorization?

Answer: Moderate-Moderate-Low, applying the high-water mark for each security objective across all information types

Under FIPS 199 and SP 800-60, the system categorization is the high-water mark for each security objective (C, I, A) across all information types processed, stored, or transmitted. That yields Moderate for confidentiality, Moderate for integrity, and Low for availability. Objectives are evaluated independently; FIPS 199 does not require a single uniform level, and information types are not averaged or diluted.

During categorization, an information owner proposes raising the provisional confidentiality impact of a Low-rated information type to Moderate because the system aggregates large volumes of records, making the compilation more sensitive than individual records. Which statement best reflects accepted categorization practice?

Answer: The adjustment is appropriate; SP 800-60 allows adjusting provisional levels based on organization-specific factors such as aggregation, with the rationale documented

SP 800-60 provisional impact levels are starting points. Analysts are expected to review and adjust them based on mission, special factors, and aggregation or compilation effects, and to document the rationale. Tailoring the control baseline afterward is a separate step and should not replace an accurate categorization.

A system security categorization was completed and approved two years ago as Moderate. The organization now plans to migrate the system to a multi-tenant cloud environment and add a new data feed that includes personally identifiable information (PII) about a vulnerable population. Which action is most appropriate with respect to the categorization?

Answer: Revisit the categorization, evaluating the new information types and PII impact, and update the security plan and any dependent control selections

Categorization must be reviewed when significant changes occur, such as new information types or a changed operating environment. Adding PII for a vulnerable population can raise confidentiality (and possibly integrity) impact, and the revised categorization must flow through to the security plan, baseline selection, and authorization decision. Impact levels are never transferred to a cloud provider.

A system supports a national-security mission and processes classified information. In addition, it is part of a program that SP 800-59 identifies as a national security system. Which statement correctly describes categorization and baseline selection?

Answer: FIPS 199 and SP 800-60 do not apply; CNSSI No. 1253 provides the categorization and baseline selection approach for national security systems

For national security systems, CNSSI No. 1253 provides the categorization and security control baseline guidance (including its own overlays and impact-level selections for C, I, and A). It supersedes the civilian FIPS 199/SP 800-60 process for these systems; categorization is still required and covers all three objectives.

An organization is categorizing a system whose availability impact is the subject of debate. The system's outage would cause only minor degradation to its own mission but would halt a downstream critical infrastructure system relying on its feed. How should the downstream effect be treated during categorization?

Answer: Considered, because impact is assessed against organizational operations, assets, individuals, other organizations, and the Nation

FIPS 199 defines potential impact in terms of adverse effects on organizational operations, organizational assets, individuals, other organizations, and the Nation. Downstream dependencies on critical infrastructure must therefore be considered when determining availability impact, regardless of whether an ISA exists.

In the RMF Categorize step, which outcome is MOST directly dependent on a complete and accurate inventory of information types and a documented system description?

Answer: Producing a defensible security categorization that supports baseline selection and is reviewed and approved by the authorizing official or designated representative

The Categorize step requires documenting system characteristics, categorizing the system based on an impact analysis of the information types, documenting the results in the security plan, and having the categorization reviewed and approved by the authorizing official or designated representative. An incomplete information-type inventory undermines every downstream step.