CGRC Information System Categorization

Question 1

Which NIST publication provides the primary guidance for categorizing federal information and information systems?

Accepted Answer

FIPS 199

Answer

NIST SP 800-53

Answer

NIST SP 800-37

Answer

FIPS 200

Question 2

In the NIST RMF, information system categorization is which step of the framework?

Accepted Answer

Step 2 – Categorize

Answer

Step 1 – Prepare

Answer

Step 3 – Select

Answer

Step 4 – Implement

Question 3

FIPS 199 defines the security category of an information system based on which three security objectives?

Accepted Answer

Confidentiality, Integrity, and Availability

Answer

Availability, Authenticity, and Integrity

Answer

Accountability, Integrity, and Availability

Answer

Confidentiality, Non-repudiation, and Availability

Question 4

When applying FIPS 199, what are the three potential impact levels for each security objective?

Accepted Answer

Low, Moderate, High

Answer

Negligible, Moderate, Severe

Answer

Low, Medium, High

Answer

Minor, Major, Critical

Question 5

The overall security category of an information system in FIPS 199 is determined by applying which rule to the impact levels of each security objective?

Accepted Answer

High-water mark (highest impact level)

Answer

Average of all impact values

Answer

Low-water mark (lowest impact level)

Answer

Median impact level across objectives

Question 6

Which NIST publication provides supplemental guidance on how to determine the security category of information types and systems per FIPS 199?

Accepted Answer

NIST SP 800-60

Answer

NIST SP 800-53A

Answer

NIST SP 800-137

Answer

NIST SP 800-39

Question 7

Who is ultimately responsible for approving the security categorization of an information system according to the NIST RMF?

Accepted Answer

System Owner

Answer

Information System Security Officer (ISSO)

Answer

Authorizing Official (AO)

Answer

Senior Agency Information Security Officer (SAISO)