CGRC Information System Categorization 3

Question 1

Which federal law requires all federal agencies to categorize their information and information systems using FIPS 199?

Accepted Answer

Federal Information Security Modernization Act (FISMA)

Answer

FISMA requires federal agencies to comply with FIPS publications, including FIPS 199, for categorizing information and information systems.

Question 2

An agency's financial system that, if unavailable, would halt mission-critical payment operations for more than 24 hours would likely receive what availability impact level?

Accepted Answer

High

Answer

A system whose unavailability halts critical mission operations represents severe or catastrophic consequences, warranting a High availability impact level under FIPS 199.

Question 3

Under NIST SP 800-60, which federal government function is an example of a 'Management and Support' information type?

Accepted Answer

Human Resources Management

Answer

Human Resources Management is a Management and Support information type under SP 800-60, as it supports internal organizational functions rather than direct mission delivery.

Question 4

What is the relationship between FIPS 199 categorization and FIPS 200 security requirements?

Accepted Answer

FIPS 199 categorization determines the minimum security requirements mandated by FIPS 200

Answer

FIPS 200 specifies minimum security requirements for federal information systems, and the categorization from FIPS 199 determines which baseline of controls from NIST SP 800-53 applies.

Question 5

Which stakeholder is primarily responsible for identifying the information types processed by a system during categorization?

Accepted Answer

System Owner in coordination with the Information Owner

Answer

The System Owner, working with Information Owners/Stewards, identifies the information types processed by the system as part of the categorization task.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Information System Categorization 3