Information System Categorization Flashcards

A federal agency is categorizing a system that processes both law enforcement investigative records (provisional impact: confidentiality High, integrity Moderate, availability Low) and routine public-facing press releases (confidentiality Low, integrity Moderate, availability Moderate). The two information types are stored in the same database and cannot be logically separated. Following NIST SP 800-60 and FIPS 199, what is the correct approach to determine the system security category?

Answer: Apply the high-water mark for each security objective across all information types, yielding SC = {(confidentiality, High), (integrity, Moderate), (availability, Moderate)}

FIPS 199 and SP 800-60 require the high-water mark applied separately to each security objective across all information types processed by the system. Confidentiality is High (law enforcement), integrity is Moderate (both), and availability is the greater of Low and Moderate, which is Moderate. Averaging is not permitted, using only one information type ignores the other's availability needs, and the generalized 'all High' result is the FIPS 200 overall high-water mark, not the FIPS 199 security category.

During categorization of a financial management system, the system owner proposes lowering the provisional integrity impact of a payment-authorization information type from High to Moderate, citing strong compensating controls already implemented (dual authorization, transaction signing). What is the most appropriate response from the CGRC practitioner?

Answer: Reject the adjustment, because security categorization is based on the potential adverse impact of loss of the objective, independent of controls that mitigate likelihood or are selected later during control tailoring

Categorization measures the magnitude of harm if confidentiality, integrity, or availability were compromised. It is intentionally independent of existing or planned controls, which are addressed in Select and later steps. Adjustments to provisional levels must be justified by organization-, mission-, or special-factor considerations, not by control strength. Option D is wrong because SP 800-60 explicitly permits documented adjustments, and the AO's risk acceptance does not make an impact justification valid.

A system processes an information type for which SP 800-60 provides provisional levels with confidentiality Low. However, the information is aggregated in bulk so that the compilation reveals patterns about critical infrastructure vulnerabilities not apparent in individual records. Which SP 800-60 concept most directly justifies raising the confidentiality impact level?

Answer: Special factors affecting the impact determination, including aggregation and compilation of data

SP 800-60 Volume 1 describes adjusting provisional impact levels based on special factors, including aggregation of data where the compiled whole carries greater sensitivity than the parts. This is a categorization step and occurs before control selection. Scoping and tailoring occur in the Select step, and CNSSI 1253 applies to national security systems.

A shared-services cloud platform hosts three tenant agencies. Tenant A's data is categorized Moderate, Tenant B's is High for confidentiality, and Tenant C's is Low. The provider wants to avoid maintaining separate authorizations. Which approach best aligns with RMF categorization guidance while maintaining valid impact determinations?

Answer: Categorize the platform at the high-water mark of tenant needs unless strong, documented logical isolation allows separate system boundaries or authorizations per tenant tier

When a shared system hosts multiple tenants' information, the system must be categorized to the highest impact among them unless the boundary can be decomposed (for example, separate authorization boundaries with verified isolation). Averaging, majority rule, or lowest-level approaches under-protect higher-sensitivity data and violate high-water mark principles.

An organization has completed categorization and the authorizing official has approved the security categorization. Six months later, the system is extended to process protected health information not previously included. According to RMF practice, what should occur?

Answer: Update the information type inventory and re-evaluate the security categorization, then reassess selected controls and any dependent authorization decisions based on the changes

Categorization must be revisited when the information types processed change. Adding PHI may raise confidentiality or integrity impact, which changes baseline selection and may require control reassessment and reauthorization consideration. Categorization is not static, is not limited to the availability objective, and does not rely on existing controls.

Under the RMF Categorize step, which task output is required to be reviewed and approved before moving to control selection, and who typically performs that approval?

Answer: The system security categorization, reviewed and approved by the authorizing official or designated representative

RMF Task C-3 requires that the security categorization results, including supporting rationale, be reviewed and approved by the authorizing official or designated representative. Baseline selection occurs in the Select step, the assessment plan is a later artifact, and POA&Ms arise from assessment findings.