CGRC Information System Categorization

Question 1

Which NIST publication provides the primary guidance for categorizing federal information and information systems?

Accepted Answer

FIPS 199

Answer

FIPS 199 (Standards for Security Categorization of Federal Information and Information Systems) is the primary standard that defines security categories for federal information and systems.

Question 2

In the NIST RMF, information system categorization is which step of the framework?

Accepted Answer

Step 2 – Categorize

Answer

Categorize is Step 2 of the NIST RMF, occurring after the Prepare step and before the Select step.

Question 3

FIPS 199 defines the security category of an information system based on which three security objectives?

Accepted Answer

Confidentiality, Integrity, and Availability

Answer

FIPS 199 uses Confidentiality, Integrity, and Availability (CIA) as the three security objectives for determining an information system's security category.

Question 4

When applying FIPS 199, what are the three potential impact levels for each security objective?

Accepted Answer

Low, Moderate, High

Answer

FIPS 199 defines Low, Moderate, and High as the three potential impact levels for each of the three security objectives.

Question 5

The overall security category of an information system in FIPS 199 is determined by applying which rule to the impact levels of each security objective?

Accepted Answer

High-water mark (highest impact level)

Answer

FIPS 199 uses the high-water mark principle, meaning the overall system categorization is the highest impact level assigned to any individual security objective.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Information System Categorization