Minimum Security Requirements for Federal Information and Information Systems
Section 5131 of the Information Technology Management Reform Act of 1996 (Public Law 104-106) > Federal Information and Information Systems

Section 5131 of the Information Technology Management Reform Act of 1996 (Public Law 104-106)

and the Federal Information Security Management Act of 2002 (Public Law 107-347).

Federal Information Processing Standards 200

March 9, 2006
Announcing the Standard for
Minimum Security Requirements for

Federal Information and Information Systems

Federal Information Processing Standards Publications (FIPS PUBS) are issued by the National
Institute of Standards and Technology (NIST) after approval by the Secretary of Commerce pursuant
to the Federal Information Security Management Act (FISMA) of 2002.
1. Name of Standard.
FIPS Publication 200: Minimum Security Requirements for Federal Information and Information
Systems.
2. Category of Standard.
Information Security.
3. Explanation.
The E-Government Act (P.L. 107-347), passed by the one hundred and seventh Congress and signed
into law by the President in December 2002, recognized the importance of information security to the
economic and national security interests of the United States. Title III of the E-Government Act,
entitled the Federal Information Security Management Act (FISMA), emphasizes the need for each
federal agency to develop, document, and implement an enterprise-wide program to provide
information security for the information and information systems that support the operations and
assets of the agency including those provided or managed by another agency, contractor, or other
source. FISMA directed the promulgation of federal standards for: (i) the security categorization of
federal information and information systems based on the objectives of providing appropriate levels of
information security according to a range of risk levels; and (ii) minimum security requirements for
information and information systems in each such category. This standard addresses the specification
of minimum security requirements for federal information and information systems.
4. Approving Authority.
Secretary of Commerce.
5. Maintenance Agency.
Department of Commerce, NIST, Information Technology Laboratory.
6. Applicability.
This standard is applicable to: (i) all information within the federal government other than that
information that has been determined pursuant to Executive Order 12958, as amended by Executive
Order 13292, or any predecessor order, or by the Atomic Energy Act of 1954, as amended, to require
protection against unauthorized disclosure and is marked to indicate its classified status; and (ii) all
federal information systems other than those information systems designated as national security
systems as defined in 44 United States Code Section 3542(b)(2). The standard has been broadly
developed from a technical perspective to complement similar standards for national security systems.
In addition to the agencies of the federal government, state, local, and tribal governments, and private
sector organizations that compose the critical infrastructure of the United States are encouraged to
consider the use of this standard, as appropriate.
7. Specifications.
FIPS Publication 200, Minimum Security Requirements for Federal Information and Information
Systems.
8. Implementations.
This standard specifies minimum security requirements for federal information and information
systems in seventeen security-related areas. Federal agencies must meet the minimum security
requirements as defined herein through the use of the security controls in accordance with NIST
Special Publication 800-53, Recommended Security Controls for Federal Information Systems, as
amended.
9. Effective Date.
This standard is effective immediately. Federal agencies must be in compliance with this standard not
later than one year from its effective date.
10. Qualifications.
The application of the security controls defined in NIST Special Publication 800-53 required by this
standard represents the current state-of-the-practice safeguards and countermeasures for information
systems. The security controls will be reviewed by NIST at least annually and, if necessary, revised
and extended to reflect: (i) the experience gained from using the controls; (ii) the changing security
requirements within federal agencies; and (iii) the new security technologies that may be available.
The minimum security controls defined in the low, moderate, and high security control baselines are
also expected to change over time as well, as the level of security and due diligence for mitigating
risks within federal agencies increases. The proposed additions, deletions, or modifications to the
catalog of security controls and the proposed changes to the security control baselines in NIST Special
Publication 800-53 will go through a rigorous, public review process to obtain government and private
sector feedback and to build consensus for the changes. Federal agencies will have up to one year
from the date of final publication to fully comply with the changes but are encouraged to initiate
compliance activities immediately.
11. Waivers.
No provision is provided under FISMA for waivers to FIPS made mandatory by the Secretary of
Commerce.
12. Where to Obtain Copies.
This publication is available from the NIST Computer Security Division web site by accessing
http://csrc.nist.gov/publications.
TABLE OF CONTENTS