Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
CATEGORIZATION

4.0 ASSIGNMENT OF IMPACT LEVELS AND SECURITY

CATEGORIZATION

This section provides a methodology for assigning security impact levels and security
categorizations for information types and information systems consistent with the organization's
assigned mission and business functions based on FIPS 199, Standards for Security
Categorization of Federal Information and Information Systems. This document assumes that
the user has read and is familiar with FIPS 199. Figure 2 illustrates the four-step security
categorization process and how it drives the selection of baseline security controls.
Identify Information
Systems
Identify
Information
Types
Select
Provisional
Impact Levels
Review
Provisional
Impact Levels
Adjust/
Finalize
Information
Impact Levels
Assign
System
Security
Category
Process Inputs
Process
Security
Categorization
Process Outputs
FIPS 200 / SP 800-53
Security Control
Selection
Figure 2: SP 800-60 Security Categorization Process Execution
Table 3 provides a step-by-step roadmap for identifying information types, establishing security
impact levels for loss of confidentiality, integrity, and availability of information types, and
assigning security categorization for the information types and for the information systems.
Security categorization is the basis for identifying an initial baseline set of security controls for
the information system.10 Each functional step in the process is explained in detail in Sections
4.1 through 4.4.
10 An information system is a discrete set of information resources organized for the collection, processing,
maintenance, use, sharing, dissemination, or disposition of information [Source: SP 800-53; FIPS 200; FIPS
199; 44 U.S.C., Sec. 3502; OMB Circular A-130, App. III]
Table 3: SP 800-60 Process Roadmap
Process Step
Activities
Roles
Input: Identify
information
systems
• Agencies should develop their own policies regarding information system identification for
security categorization purposes. The system is generally bounded by a security
perimeter11.
CIO; SAISO;
Mission
Owners
Step 1
• Document the agency's business and mission areas
• Identify all of the information types that are input, stored, processed, and/or output from
each system [Section 4.1]
o Identify Mission-based Information Type categories based on supporting FEA Lines of
Business [Section 4.1.1]
o As applicable, identify Management and Support Information Type categories based on
supporting FEA Lines of Business [Section 4.1.2]
o Specify applicable sub-functions for the identified Mission-based and Management and
Support categories [Volume II, Appendices C and D]
o As necessary, identify other required information types [Sections 4.1.3, 4.1.4]
• Document applicable information types for the identified information system along with the
basis for the information type selection [Section 4.5]
Mission
Owners;
Information
Owners
Step 2
• Select the security impact levels for the identified information types
o from the recommended provisional impact levels for each identified information type
[Volume II, Appendices C and D)
o or, from FIPS 199 criteria provided in Table 7 Section 4.2.1, and Section 4.2.2
• Determine the security category (SC) for each information type: SC information type =
{(confidentiality, impact), (integrity, impact), (availability, impact)}
• Document the provisional impact level of confidentiality, integrity, and availability associated
with the system's information type [Section 4.5]
Information
System
Security
Officer (ISSO)
Step 3
• Review the appropriateness of the provisional impact levels based on the organization,
environment, mission, use, and data sharing [Section 4.3]
• Adjust the impact levels as necessary based on the following considerations:
o Confidentiality, integrity, and availability factors [Section 4.2.2]
o Situational and operational drivers (timing, lifecycle, etc.) [Section 4.3]
o Legal or statutory reasons
• Document all adjustments to the impact levels and provide the rationale or justification for
the adjustments [Section 4.5]
SAISO; ISSO;
Mission
Owners;
Information
Owners
Step 4
• Review identified security categorizations for the aggregate of information types.
• Determine the system security categorization by identifying the security impact level high
water mark for each of the security objectives (confidentiality, integrity, availability):
SC System X = {(confidentiality, impact), (integrity, impact), (availability, impact)}
• Adjust the security impact level high water mark for each system security objective, as
necessary, by applying the factors discussed in section 4.4.2.
• Assign the overall information system impact level based on the highest impact level for the
system security objectives (confidentiality, integrity, availability)
• Follow the agency's oversight process for reviewing, approving, and documenting all
determinations or decisions [Section 4.5]
CIO, SAISO;
ISSO; Mission
Owners;
Information
Owners
Output: Security
Categorization
• Output that can be used as input to the selection of the set of security controls necessary
for each system and the system risk assessment
• The minimum security controls recommended for each system security category can be
found in NIST SP 800-53, as updated
CIO; ISSO;
Authorizing
Officials;
Developers
11 Security perimeter is synonymous with the term accreditation boundary and includes all components of an
information system to be accredited by an authorizing official and excludes separately accredited systems to
which the information system is connected.