ezesecops/rmf-ato-core huggingface dataset:
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
1.4 Organization of this Special Publication

1.4 Organization of this Special Publication

This is Volume I of two volumes. It contains the basic guidelines for mapping types of
information and information systems to security categories. The appendices, including security
categorization recommendations for mission-based information types and rationale for security
categorization recommendations, are published as a separate Volume II.
Volume I provides the following background information and mapping guidelines:
• Section 2: Provides an overview of the value of the categorization process to agency
missions, security programs and overall information technology (IT) management and the
publication's role in the system development lifecycle, the certification and accreditation
process, and the NIST Risk Management Framework.
• Section 3: Provides the security objectives and corresponding security impact levels
identified in the Federal Information Processing Standard 199, Standards for Security
Categorization of Federal Information and Information Systems [FIPS 199];
3 This document is currently under revision and will be reissued as Special Publication 800-30, Revision 1,
Guide for Conducting Risk Assessments.
• Section 4: Identifies the process including guidelines for identification of mission-based
and management and support information types and the process used to select security
impact levels, general considerations relating to security impact assignment, guidelines
for system security categorization, and considerations and guidelines for applying and
interrelating system categorization results to the agency's enterprise, large supporting
infrastructures, and interconnecting systems;
• Appendix A: Glossary; and
• Appendix B: References.
Volume II includes the following appendices:
• Appendix A: Glossary [Repeated];
• Appendix B: References [Repeated];
• Appendix C: Provisional security impact level assignments and supporting rationale
for management and support information (administrative, management, and service
information);
• Appendix D: Provisional security impact level assignments and supporting rationale
for mission-based information (mission information and services delivery
mechanisms); and
• Appendix E: Legislative and executive sources that specify sensitivity/criticality
properties.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
2.0 PUBLICATION OVERVIEW

2.0 PUBLICATION OVERVIEW

Security categorization provides a vital step in integrating security into the government agency's
business and information technology management functions and establishes the foundation for
security standardization amongst their information systems. Security categorization starts with
the identification of what information supports which government lines of business, as defined
by the Federal Enterprise Architecture (FEA). Subsequent steps focus on the evaluation of the
need for security in terms of confidentiality, integrity, and availability. The result is strong
linkage between missions, information, and information systems with cost effective information
security.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
2.1 Agencies Support the Security Categorization Process

2.1 Agencies Support the Security Categorization Process

Agencies support the categorization process by establishing mission-based information types for
the organization. The approach to establishing mission-based information types at an agency
begins by documenting the agency's mission and business areas. In the case of mission-based
information, the responsible individuals, in coordination with management, operational,
enterprise architecture, and security stakeholders, should compile a comprehensive set of the
agency's lines of business and mission areas. In addition, responsible individuals should identify
the applicable sub-functions necessary to accomplish the organization's mission. For example,
one organization's mission might be related to economic development. Sub-functions that are
part of the organization's economic development mission might include business and industry
development, intellectual property protection, or financial sector oversight. Each of these sub-
functions represents an information type.
Agencies should conduct FIPS 199 security categorizations of their information systems as an
agency-wide activity with the involvement of the senior leadership and other key officials within
the organization (e.g., mission and business owners, authorizing officials, risk executive, chief
information officer, senior agency information security officer, information system owners, and
information owners) to ensure that each information system receives the appropriate
management oversight and reflects the needs of the organization as a whole. Senior leadership
oversight in the security categorization process is essential so that the next steps in the NIST
Risk Management Framework4 (e.g., security control selection) can be carried out in an effective
and consistent manner throughout the agency.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
2.2 Value to Agency Missions, Security Programs and IT Management

2.2 Value to Agency Missions, Security Programs and IT Management

Federal agencies are heavily dependent upon information and information systems to
successfully conduct critical missions. With an increasing reliability on and growing complexity
of information systems as well as a constantly changing risk environment, information security
has become a mission-essential function. This function must be conducted in a manner that
reduces the risks to the information entrusted to the agency, its overall mission, and its ability to
do business and to serve the American public. In the end, information security, as a function,
becomes a business enabler through diligent and effective management of risk to information
confidentiality, integrity, and availability.
4 See Section 2.5, Figure 1: NIST Risk Management Framework
Therefore, the value of information security categorization is to enable agencies to proactively
implement appropriate information security controls based on the assessed potential impact to
information confidentiality, integrity, and availability and in turn to support their mission in a
cost-effective manner. An incorrect information system impact analysis (i.e., incorrect FIPS 199
security categorization) can result in the agency either over protecting the information system
thus wasting valuable security resources, or under protecting the information system and placing
important operations and assets at risk. The aggregation of such mistakes at the enterprise level
can further compound the problem.
In contrast, conducting FIPS 199 impact analyses as an agency-wide exercise with the
participation of key officials (e.g., Chief Information Officer [CIO], Senior Agency Information
Security Officer [SAISO], Authorizing Officials, Mission/System Owners) at multiple levels can
enable the agency to leverage economies of scale through the effective management and
implementation of security controls at the enterprise level. A resulting value of consistently
implementing this systematic process for determining the security categorization and the
application of appropriate security protection is an improved overall understanding of the
agency's mission, business processes, and information and system ownership.
Implementation Tip
To enable an appropriate level of mission support and the diligent
implementation of current and future information security requirements,
each agency should establish a formal process to validate system level
security categorizations in terms of agency priorities. This will not only
promote comparable evaluation of systems, but also yield added benefits to
include leveraging common security controls and establishing defense-in-
depth.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
2.3 Role in the System Development Lifecycle

2.3 Role in the System Development Lifecycle

An initial security categorization should occur early in the agency's system development
lifecycle (SDLC). The resulting security categorization would feed into security requirements
identification (later to evolve into security controls) and other related activities such as privacy
impact analysis or critical infrastructure analysis. Ultimately, the identified security requirements
and selected security controls are introduced to the standard systems engineering process to
effectively integrate the security controls with the information systems functional and
operational requirements, as well as other pertinent system requirements (e.g., reliability,
maintainability, supportability).
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
2.4 Role in the Certification and Accreditation Process

2.4 Role in the Certification and Accreditation Process

Security categorization establishes the foundation of the certification and accreditation (C&A)
activity by determining the levels of rigor required for certification and overall assurance testing
of security controls, as well as additional activities that may be needed (i.e., privacy and critical
infrastructure protection (CIP)). Thus, it assists in determining C&A level of effort and
associated activity duration.
Security categorization is a prerequisite activity for the C&A process. The categorization should
be revisited at least every three years or when significant change occurs to the system or
supporting business lines. Situational changes outside the system or agency may require a
reevaluation of the categorization (i.e., directed mission changes, changes in governance,
elevated or targeted threat activities). For more information, see NIST SP 800-64, Security
Considerations in the Information System Development Life Cycle and NIST SP 800-37, Guide
for the Security Certification and Accreditation of Federal Information Systems.
Implementation Tip
It is important to routinely revisit the security categorization as the
mission/ business changes because it is likely the impact levels or even
information types may change as well.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
2.5 Role in the NIST Risk Management Framework

2.5 Role in the NIST Risk Management Framework

Security Categorization is the key first step in the Risk Management Framework5 because of its
effect on all other steps in the framework from selection of security controls to level of effort in
assessing security control effectiveness.
Figure 1, NIST Risk Management Framework, depicts the role of NIST security standards and
guidelines for information system security.
5 NIST SP 800-39, Managing Risk from Information Systems: An Organizational Perspective, (Initial Public
Draft), October 2007.
Figure 1: NIST Risk Management Framework
The security categorization process documented in this publication provides input into the
following processes:
• Step 2: Select an initial set of security controls for the information system based on the
FIPS 199 security categorization and apply tailoring guidance as appropriate, to obtain a
starting point for required controls as specified in FIPS 200, Minimum Security
Requirements for Federal Information and Information Systems and NIST SP 800-53,
Recommended Security Controls for Federal Information Systems. Utilizing NIST SP
800-53 and SP 800-30, Risk Management Guide for Information Technology Systems,
supplement the initial set of tailored security controls based on an assessment of risk and
local conditions including organization-specific security requirements, specific threat
information, cost-benefit analyses, or special circumstances.
• Step 3: Implement the security controls in the information system.
• Step 4: Assess the security controls using appropriate methods and procedures to
determine the extent to which the controls are implemented correctly, operating as
intended, and producing the desired outcome with respect to meeting the security
requirements for the system. (Reference NIST SP 800-53A, Guide for Assessing the
Security Controls in Federal Information Systems).
• Step 5: Authorize information system operation based upon a determination of the risk to
organizational operations, organizational assets, or to individuals resulting from the
operation of the information system and the decision that this risk is acceptable as
specified in NIST SP 800-37, Guide for the Security Certification and Accreditation of
Federal Information Systems.
• Step 6: Monitor and assess selected security controls in the information system on a
continuous basis including documenting changes to the system, conducting security
impact analyses of the associated changes, and reporting the security status of the system
to appropriate organizational officials on a regular basis. (Reference NIST SP 800-37 and
SP 800-53A).
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
3.1 Security Categories and Objectives > 3.1.1 Security Categories

3.1.1 Security Categories

FIPS 199 establishes security categories for both information6 and information systems. The
security categories are based on the potential impact on an organization should certain events
occur. The potential impacts could jeopardize the information and information systems needed
by the organization to accomplish its assigned mission, protect its assets, fulfill its legal
responsibilities, maintain its day-to-day functions, and protect individuals. Security categories
are to be used in conjunction with vulnerability and threat information in assessing the risk to an
organization.
FIPS 199 establishes three potential levels of impact (low, moderate, and high) relevant to
securing Federal information and information systems for each of three stated security objectives
(confidentiality, integrity, and availability).
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
3.1 Security Categories and Objectives > 3.1.2 Security Objectives and Types of Potential Losses

3.1.2 Security Objectives and Types of Potential Losses

As reflected in Table 1, FISMA and FIPS 199 define three security objectives for information
and information systems.
Table 1: Information and Information System Security Objectives
Security
Objectives
FISMA Definition [44 U.S.C., Sec. 3542]
FIPS 199 Definition
Confidentiality
"Preserving authorized restrictions on information
access and disclosure, including means for protecting
personal privacy and proprietary information..."
A loss of confidentiality is the
unauthorized disclosure of
information.
Integrity
"Guarding against improper information
modification or destruction, and includes ensuring
information non-repudiation and authenticity..."
A loss of integrity is the unauthorized
modification or destruction of
information.
Availability
"Ensuring timely and reliable access to and use of
information..."
A loss of availability is the disruption
of access to or use of information or
an information system.
6 Information is categorized according to its information type. An information type is a specific category of
information (e.g., privacy, medical, proprietary, financial, investigative, contractor sensitive, security
management) defined by an organization or, in some instances, by a specific law, Executive Order, directive,
policy, or regulation.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
4.1 Step 1: Identify Information Types

4.1 Step 1: Identify Information Types

In accordance with FIPS 199, agencies shall identify all of the applicable information types that
are representative of input, stored, processed, and/or output data from each system. The initial
activity in mapping types of Federal information and information systems to security objectives
and impact levels is the development of an information taxonomy, or creation of a catalog of
information types.12 The basis for the identification of information types is the OMB's Business
Reference Model (BRM) described in the October 2007 publication, FEA Consolidated
Reference Model Document, Version 2.3. The BRM describes four business areas containing 39
FEA lines of business.13 The four business areas separate government operations into high-level
categories relating:
• The purpose of government (services for citizens);
• The mechanisms the government uses to achieve its purpose (mode of delivery);
• The support functions necessary to conduct government operations (support delivery
of services); and
• The resource management functions that support all areas of the government's
business (management of government resources).
The first two business areas, services for citizens and the mode of delivery represent the NIST SP
800-60 Mission-based Information Types and will be discussed first in the following section,
while support delivery of services and management of government resources represent
Management and Support Information Types and will be presented in Section 4.1.2.
Although this guideline identifies a number of information types and bases its taxonomy on the
BRM, only a few of the types identified are likely to be processed by any single system. Also,
each system may process information that does not fall neatly into one of the listed information
types. Once a set of information types identified in this guideline has been selected, it is prudent
to review the information processed by each system under review to see if additional types need
to be identified for impact assessment purposes. Also, it is recommended that organizational
officials maintain proper documentation of identified information types per information system
along with the basis for the information type selection. Guidance for documenting information
types is provided in Section 4.5.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
4.1 Step 1: Identify Information Types > 4.1.1 Identification of Mission-based Information Types

4.1.1 Identification of Mission-based Information Types

This section describes a process for identifying mission-based information types and for
specifying the impact of unauthorized disclosure, modification, or unavailability of this
information. Mission-based information types are, by definition, specific to individual
departments and agencies or to specific sets of departments and agencies. The BRM services for
citizens business area provides the primary frame of reference for determining the security
12 One issue associated with the taxonomy activity is the determination of the degree of granularity. If the
categories are too broad, then the guidelines for assigning impact levels are likely to be too general to be useful.
On the other hand, if an attempt is made to provide guidelines for each element of information processed by
each government agency, the guideline is likely to be unwieldy and to require excessively frequent changes.
13 Definitions are provided in SP 800-60 Appendix A for the BRM terms such as "Business Areas", "Lines of
Businesses" and "Sub-functions".
objectives impact levels for mission-based information and information systems. The
consequences or impact of unauthorized disclosure of information, modification or destruction of
information, and disruption of access to or use of information are defined by the nature and
beneficiary of the service being provided or supported. The BRM establishes 26 direct services
and delivery support lines of business with 98 associated information types (reference Table 4).
Two additional information types were included to address Executive Functions of the Executive
Office of the President and Trade Law Enforcement. These additions are identified by italics in
Table 4.
Table 4: Mission-Based Information Types and Delivery Mechanisms14
Mission Areas and Information Types [Services for Citizens]
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.1.2 Identification of Management and Support Information

4.1.2 Identification of Management and Support Information

Much Federal government information and many supporting information systems are not
employed directly to provide direct mission-based services, but are primarily intended to support
delivery of services or to manage resources. The support delivery of services and management of
resources business areas are together composed of 13 lines of business (Tables 5 and 6). The
BRM subdivides the lines of business into 72 sub-functions. The support delivery of services and
management of resource business areas are common to most Federal government agencies, and
the information associated with each of their sub-functions is identified in this guideline as a
management and support information type. Four additional management and support sub-factor
information types have been defined to address privacy information. One additional
management and support sub-factor information type has been defined to address General
Information as a catch-all information type that may not be defined by the FEA BRM. As such,
agencies may find it necessary to identify additional information types not defined in the BRM
and assign associated security impact levels to those types.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.1.3 Legislative and Executive Information Mandates

4.1.3 Legislative and Executive Information Mandates

During the identification of information types within an information system, agency personnel
should afford special consideration for applicable governances addressing the information
processed and the agency's supported mission. Volume II, Appendix E lists legislative and
executive mandates establishing sensitivity and criticality guidelines for specific information
types.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.1.4 Identifying Information Types Not Listed in this Guideline

4.1.4 Identifying Information Types Not Listed in this Guideline

The FEA BRM Information Types are provided only as a taxonomy guideline. Not all
information processed by an information system may be identified from Tables 4 through 6.
Therefore, an agency may identify unique information types not listed in this guideline or may
choose not to select provisional impact levels from Volume II, Appendix C (for management and
support information types) or Volume II, Appendix D (for mission-based information types).
Sections 4.2.1 through 4.2.3 of this guideline provide assistance to agencies in assigning
provisional security categories to agency-identified information types and information systems.
Additionally, SP 800-60 provides a management and support sub function, General Information
Type, which can be used by agencies as a means to identify and categorize information not
16 The recommended information types provided in NIST SP 800-60 are established from the "business areas"
and "lines of business" from OMB's Business Reference Model (BRM) section of Federal Enterprise
Architecture (FEA) Consolidated Reference Model Document Version 2.3, October 2007.
contained in the FEA BRM. A complete description of the General Information Type
information should be captured in the agency's collection and documentation process.