Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.2 Step 2: Select Provisional Impact Level > 4.2.1 FIPS 199 Security Categorization Criteria

4.2.1 FIPS 199 Security Categorization Criteria

Where an information type processed by an information system is not categorized by this
guideline [based on information types identified in Volume II, Appendices C and D], an initial
impact determination will need to be made based on FIPS 199 categorization criteria (cited in
Table 7).
Agencies can assign security categories to information types and information systems by
selecting and adjusting appropriate Table 7 values for the potential impact of compromises of
confidentiality, integrity, and availability security objectives. Those responsible for impact level
selection and subsequent security categorization should apply the criteria provided in Table 7 to
each information type received by, processed in, stored in, and/or generated by each system for
which they are responsible. The security categorization will generally be determined based on
the most sensitive or critical information received by, processed in, stored in, and/or generated
by the system under review.
17 Impact levels (plural), as used here, refers to low, moderate, high, or not applicable values assigned to each
security objective (i.e., confidentiality, integrity, and availability) used in expressing the security category of an
information type or information systems. The value of not applicable only applies to information types and not
to information systems.
Table 7: Categorization of Federal Information and Information Systems
POTENTIAL IMPACT
SECURITY OBJECTIVE
LOW
MODERATE
HIGH
Confidentiality
Preserving authorized
restrictions on information
access and disclosure,
including means for
protecting personal privacy
and proprietary information.
[44 U.S.C., SEC. 3542]
The unauthorized disclosure
of information could be
expected to have a limited
adverse effect on
organizational operations,
organizational assets, or
individuals.
The unauthorized disclosure
of information could be
expected to have a serious
adverse effect on
organizational operations,
organizational assets, or
individuals.
The unauthorized disclosure
of information could be
expected to have a severe
or catastrophic adverse
effect on organizational
operations, organizational
assets, or individuals.
Integrity
Guarding against improper
information modification or
destruction, and includes
ensuring information non-
repudiation and authenticity.
[44 U.S.C., SEC. 3542]
The unauthorized
modification or destruction
of information could be
expected to have a limited
adverse effect on
organizational operations,
organizational assets, or
individuals.
The unauthorized
modification or destruction
of information could be
expected to have a serious
adverse effect on
organizational operations,
organizational assets, or
individuals.
The unauthorized modi-
fication or destruction of
information could be
expected to have a severe
or catastrophic adverse
effect on organizational
operations, organizational
assets, or individuals.
Availability
Ensuring timely and reliable
access to and use of
information.
[44 U.S.C., SEC. 3542]
The disruption of access to
or use of information or an
information system could be
expected to have a limited
adverse effect on
organizational operations,
organizational assets, or
individuals.
The disruption of access to
or use of information or an
information system could be
expected to have a serious
adverse effect on
organizational operations,
organizational assets, or
individuals.
The disruption of access to
or use of information or an
information system could be
expected to have a severe
or catastrophic adverse
effect on organizational
operations, organizational
assets, or individuals.