Information System Categorization Flashcards

Which NIST publication provides the primary guidance for categorizing federal information and information systems?

Answer: FIPS 199

FIPS 199 (Standards for Security Categorization of Federal Information and Information Systems) is the primary standard that defines security categories for federal information and systems.

In the NIST RMF, information system categorization is which step of the framework?

Answer: Step 2 – Categorize

Categorize is Step 2 of the NIST RMF, occurring after the Prepare step and before the Select step.

FIPS 199 defines the security category of an information system based on which three security objectives?

Answer: Confidentiality, Integrity, and Availability

FIPS 199 uses Confidentiality, Integrity, and Availability (CIA) as the three security objectives for determining an information system's security category.

When applying FIPS 199, what are the three potential impact levels for each security objective?

Answer: Low, Moderate, High

FIPS 199 defines Low, Moderate, and High as the three potential impact levels for each of the three security objectives.

The overall security category of an information system in FIPS 199 is determined by applying which rule to the impact levels of each security objective?

Answer: High-water mark (highest impact level)

FIPS 199 uses the high-water mark principle, meaning the overall system categorization is the highest impact level assigned to any individual security objective.

Which NIST publication provides supplemental guidance on how to determine the security category of information types and systems per FIPS 199?

Answer: NIST SP 800-60

NIST SP 800-60 (Guide for Mapping Types of Information and Information Systems to Security Categories) supplements FIPS 199 by providing mappings for categorizing specific information types.

Who is ultimately responsible for approving the security categorization of an information system according to the NIST RMF?

Answer: System Owner

The System Owner is responsible for categorizing the information system and ensuring the categorization is reviewed and approved by senior officials, with the AO ultimately concurring.

When categorizing information types, if an information system processes both 'Moderate' confidentiality data and 'High' availability data, what is the system's overall security category?

Answer: High

Using the high-water mark principle from FIPS 199, the overall security category is High because that is the highest impact level across all security objectives.

Which document formally records the security categorization decision for an information system as part of the RMF process?

Answer: System Security Plan (SSP)

The System Security Plan (SSP) formally documents the security categorization along with the system description, boundary, and selected controls.

In the NIST SP 800-60 framework, information is grouped into what two broad categories?

Answer: Mission-based and Management support

NIST SP 800-60 groups government information into Mission-based information types and Management and Support information types.

A system that stores Social Security Numbers and other PII is likely to receive a HIGH impact rating for which security objective above others?

Answer: Confidentiality

Personally Identifiable Information (PII) is primarily sensitive because unauthorized disclosure can cause serious harm, making Confidentiality the primary concern with a High impact rating.

Which of the following best describes a 'HIGH' impact level under FIPS 199?

Answer: Severe or catastrophic adverse effects on organizational operations, assets, or individuals

FIPS 199 defines a HIGH impact as one where a loss could be expected to have a severe or catastrophic adverse effect on organizational operations, assets, or individuals.

What term does FIPS 199 use to describe the format for expressing a system's security category?

Answer: SC (system) = {(confidentiality, impact), (integrity, impact), (availability, impact)}

FIPS 199 expresses a security category as SC (information type) = {(confidentiality, impact level), (integrity, impact level), (availability, impact level)}.

When should security categorization be revisited during the system lifecycle?

Answer: Whenever significant changes occur to the system or its operating environment

Security categorization should be reviewed and updated whenever significant changes occur to the system, the information it processes, or the operating environment.

Which federal law requires all federal agencies to categorize their information and information systems using FIPS 199?

Answer: Federal Information Security Modernization Act (FISMA)

FISMA requires federal agencies to comply with FIPS publications, including FIPS 199, for categorizing information and information systems.

An agency's financial system that, if unavailable, would halt mission-critical payment operations for more than 24 hours would likely receive what availability impact level?

Answer: High

A system whose unavailability halts critical mission operations represents severe or catastrophic consequences, warranting a High availability impact level under FIPS 199.

Under NIST SP 800-60, which federal government function is an example of a 'Management and Support' information type?

Answer: Human Resources Management

Human Resources Management is a Management and Support information type under SP 800-60, as it supports internal organizational functions rather than direct mission delivery.

What is the relationship between FIPS 199 categorization and FIPS 200 security requirements?

Answer: FIPS 199 categorization determines the minimum security requirements mandated by FIPS 200

FIPS 200 specifies minimum security requirements for federal information systems, and the categorization from FIPS 199 determines which baseline of controls from NIST SP 800-53 applies.

Which stakeholder is primarily responsible for identifying the information types processed by a system during categorization?

Answer: System Owner in coordination with the Information Owner

The System Owner, working with Information Owners/Stewards, identifies the information types processed by the system as part of the categorization task.

A 'LOW' impact level in FIPS 199 indicates that loss of the security objective would have what type of effect?

Answer: Limited adverse effects on organizational operations, assets, or individuals

FIPS 199 defines LOW impact as loss of confidentiality, integrity, or availability that could be expected to have a limited adverse effect on organizational operations, assets, or individuals.