Information System Categorization Flashcards

A federal agency is categorizing a system that processes both law enforcement investigative records (provisional impact: Confidentiality High, Integrity Moderate, Availability Low) and routine public-facing press releases (Confidentiality Low, Integrity Moderate, Availability Moderate). Following NIST SP 800-60 and FIPS 199, what is the correct system security categorization if the two information types reside on the same system with no logical separation?

Answer: SC = {(confidentiality, High), (integrity, Moderate), (availability, Moderate)}

Under FIPS 199 and NIST SP 800-60, the system categorization is the high-water mark applied independently to each security objective across all information types. Confidentiality = High (from the law enforcement records), Integrity = Moderate (both), Availability = Moderate (press releases are Moderate, which exceeds Low). Averaging is never used, and the highest type does not govern all objectives wholesale.

During categorization of a payroll system, the system owner notes that the provisional impact level for an information type's confidentiality in NIST SP 800-60 is Low, but the organization's aggregation of 400,000 employee records, including SSNs and bank details, would cause severe harm if disclosed. Which action is most consistent with the SP 800-60 adjustment guidance?

Answer: Adjust the confidentiality impact level upward based on the aggregation and special factors, and document the rationale

SP 800-60 provisional impact levels are starting points. Organizations must review them and adjust (up or down) based on organization-specific factors such as volume of records, aggregation of PII, and mission context, documenting the rationale. Baseline selection follows categorization and cannot compensate for an inaccurate one.

A system's security categorization is completed in the Categorize step of the RMF (SP 800-37 Rev. 2). Six months later, the organization consolidates it with another system, adding a new information type with a High availability impact. Which statement best reflects the correct approach?

Answer: The categorization must be revisited because a change in information types may change the system categorization, and the downstream steps (Select, Implement, Assess) must be re-evaluated for impact

Security categorization must be reviewed when changes to the system or its information types could alter impact levels. Adding a High availability information type may raise the system's availability categorization, which flows into control baseline selection and the later RMF steps. Splitting is a possible design decision, not an automatic one, and must be justified by true isolation.

Which of the following best describes how a system providing a function that supports a national security system (NSS) is categorized, compared to a non-NSS federal system?

Answer: NSS systems are categorized using CNSSI 1253, which applies the same impact levels but adds overlays and specific guidance, and the Committee on National Security Systems provides governing direction

CNSSI 1253 provides categorization and control selection guidance for NSS, including overlays and security objective impact assignment. It operates under CNSS authority rather than purely NIST/OMB direction, though it aligns with FIPS 199 impact definitions and the three security objectives.

An agency categorizes a shared cloud-hosted general support system that supplies identity services to ten mission applications. The identity service has no direct mission information type of its own. How should its categorization be determined?

Answer: It is categorized based on the information types it processes and the impact if its function is compromised, including the highest impact among the dependent mission applications

SP 800-60 notes that for infrastructure and support systems, the categorization must reflect the information it processes (such as authentication data) and the potential impact on dependent systems. The shared service must support the highest impact level of what depends on it, since its compromise affects those mission functions.

Under FIPS 199, how should the potential impact be rated when a loss of integrity is expected to have a limited adverse effect on organizational operations but a serious adverse effect on individuals?

Answer: High, because any serious adverse effect on individuals automatically means High

FIPS 199 defines High as a severe or catastrophic adverse effect, Moderate as serious, and Low as limited. The potential impact value is determined by the worst effect across organizational operations, organizational assets, individuals, other organizations, or the Nation. Here the effect on individuals is described as serious, which is Moderate, so option 3 as written is mistaken; the correct reading is that the rating is the highest of the effects, which is Moderate.