ezesecops/rmf-ato-core huggingface dataset:
Standards for Security Categorization of Federal Information and Information Systems
3 CATEGORIZATION OF INFORMATION AND INFORMATION SYSTEMS > Security Objectives

Security Objectives

The FISMA defines three security objectives for information and information systems:
CONFIDENTIALITY
"Preserving authorized restrictions on information access and disclosure, including means for
protecting personal privacy and proprietary information..." [44 U.S.C., Sec. 3542]
A loss of confidentiality is the unauthorized disclosure of information.
INTEGRITY
"Guarding against improper information modification or destruction, and includes ensuring
information non-repudiation and authenticity..." [44 U.S.C., Sec. 3542]
A loss of integrity is the unauthorized modification or destruction of information.
AVAILABILITY
"Ensuring timely and reliable access to and use of information..." [44 U.S.C., SEC. 3542]
A loss of availability is the disruption of access to or use of information or an information system.
Standards for Security Categorization of Federal Information and Information Systems
Table 1 > Potential Impact Definitions for Security Objectives

Table 1: Potential Impact Definitions for Security Objectives (FIPS 199).
The potential impact on each security objective, by impact level:

Confidentiality (definition): Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information. [44 U.S.C., SEC. 3542]
Confidentiality / LOW: The unauthorized disclosure of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.
Confidentiality / MODERATE: The unauthorized disclosure of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.
Confidentiality / HIGH: The unauthorized disclosure of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
Integrity (definition): Guarding against improper information modification or destruction, and includes ensuring information non- repudiation and authenticity. [44 U.S.C., SEC. 3542]
Integrity / LOW: The unauthorized modification or destruction of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.
Integrity / MODERATE: The unauthorized modification or destruction of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.
Integrity / HIGH: The unauthorized modification or destruction of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
Availability (definition): Ensuring timely and reliable access to and use of information. [44 U.S.C., SEC. 3542]
Availability / LOW: The disruption of access to or use of information or an information system could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.
Availability / MODERATE: The disruption of access to or use of information or an information system could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.
Availability / HIGH: The disruption of access to or use of information or an information system could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
Minimum Security Requirements for Federal Information and Information Systems
APPENDIX A TERMS AND DEFINITIONS > ACCREDITATION

ACCREDITATION: The official management decision given by a senior agency official to authorize operation of an information system and to explicitly accept the risk to agency operations (including mission, functions, image, or reputation), agency assets, or individuals, based on the implementation of an agreed-upon set of security controls.
Minimum Security Requirements for Federal Information and Information Systems
APPENDIX A TERMS AND DEFINITIONS > ADEQUATE SECURITY

ADEQUATE SECURITY: Security commensurate with the risk and the magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of information. [OMB Circular A-130,
Minimum Security Requirements for Federal Information and Information Systems
1 PURPOSE

1 PURPOSE

The E-Government Act of 2002 (Public Law 107-347), passed by the one hundred and seventh
Congress and signed into law by the President in December 2002, recognized the importance of
information security to the economic and national security interests of the United States. Title III of
the E-Government Act, entitled the Federal Information Security Management Act (FISMA) of 2002,
tasked NIST with the responsibility of developing security standards and guidelines for the federal
government including the development of:
•
Standards for categorizing information and information systems1 collected or maintained by
or on behalf of each federal agency based on the objectives of providing appropriate levels of
information security according to a range of risk levels;
•
Guidelines recommending the types of information and information systems to be included in
each category; and
•
Minimum information security requirements for information and information systems in each
such category.
FIPS Publication 199, Standards for Security Categorization of Federal Information and Information
Systems, approved by the Secretary of Commerce in February 2004, is the first of two mandatory
security standards required by the FISMA legislation.2 FIPS Publication 200, the second of the
mandatory security standards, specifies minimum security requirements for information and
information systems supporting the executive agencies of the federal government and a risk-based
process for selecting the security controls necessary to satisfy the minimum security requirements.
This standard will promote the development, implementation, and operation of more secure
information systems within the federal government by establishing minimum levels of due diligence
for information security and facilitating a more consistent, comparable, and repeatable approach for
selecting and specifying security controls for information systems that meet minimum security
requirements.
Minimum Security Requirements for Federal Information and Information Systems
2 INFORMATION SYSTEM IMPACT LEVELS

2 INFORMATION SYSTEM IMPACT LEVELS

FIPS Publication 199 requires agencies to categorize their information systems as low-impact,
moderate-impact, or high-impact for the security objectives of confidentiality, integrity, and
availability. The potential impact values assigned to the respective security objectives are the highest
values (i.e., high water mark3) from among the security categories that have been determined for each
type of information resident on those information systems.4 The generalized format for expressing the
security category (SC) of an information system is:
SC information system = {(confidentiality, impact), (integrity, impact), (availability, impact)},
where the acceptable values for potential impact are low, moderate, or high.
1 An information system is a discrete set of information resources organized for the collection, processing, maintenance,
use, sharing, dissemination, or disposition of information. Information resources include information and related
resources, such as personnel, equipment, funds, and information technology.
2 NIST security standards and guidelines referenced in this publication are available at http://csrc.nist.gov.
3 The high water mark concept is employed because there are significant dependencies among the security objectives of
confidentiality, integrity, and availability. In most cases, a compromise in one security objective ultimately affects the
other security objectives as well.
4 NIST Special Publication 800-60, Guide for Mapping Types of Information and Information Systems to Security
Categories, provides implementation guidance on the assignment of security categories to information and information
systems.
Since the potential impact values for confidentiality, integrity, and availability may not always be the
same for a particular information system, the high water mark concept must be used to determine the
overall impact level of the information system. Thus, a low-impact system is an information system in
which all three of the security objectives are low. A moderate-impact system is an information system
in which at least one of the security objectives is moderate and no security objective is greater than
moderate. And finally, a high-impact system is an information system in which at least one security
objective is high. The determination of information system impact levels must be accomplished prior
to the consideration of minimum security requirements and the selection of appropriate security
controls for those information systems.
Minimum Security Requirements for Federal Information and Information Systems
3 MINIMUM SECURITY REQUIREMENTS > Specifications for Minimum Security Requirements > AC

Access Control (AC): Organizations must limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems) and to the types of transactions and functions that authorized users are permitted to exercise.
Minimum Security Requirements for Federal Information and Information Systems
REFERENCES

REFERENCES

[1]
Committee for National Security Systems (CNSS) Instruction 4009, National Information
Assurance Glossary, May 2003.
[2]
E-Government Act of 2002 (Public Law 107-347), December 2002.
[3]
Federal Information Processing Standards Publication 199, Standards for Security
Categorization of Federal Information and Information Systems, February 2004.
[4]
Federal Information Security Management Act of 2002 (Public Law 107-347, Title III),
December 2002.
[5]
Information Technology Management Reform Act of 1996 (Public Law 104-106), August
1996.
[6]
Guide for Developing Security Plans for Federal Information Systems, February 2006.
[7]
Security Controls for Federal Information Systems, February 2005.
[8]
Mapping Types of Information and Information Systems to Security Categories, June 2004.
[9]
Office of Management and Budget, Circular A-130, Transmittal Memorandum #4,
Management of Federal Information Resources, Appendix III, Security of Federal Automated
Information Resources, November 2000.
Minimum Security Requirements for Federal Information and Information Systems
ACRONYMS

ACRONYMS

CIO
Chief Information Officer
CNSS
Committee for National Security Systems
FIPS
Federal Information Processing Standards
FISMA
Federal Information Security Management Act
NIST
OMB
Office of Management and Budget
USC
United States Code
Minimum Security Requirements for Federal Information and Information Systems
Appendix III] (part 3)

The management, operational, and technical controls (i.e., safeguards or
countermeasures) prescribed for an information system to protect the confidentiality, integrity, and
availability of the system and its information. [FIPS Publication 199]
SECURITY CONTROL BASELINE: The set of minimum security controls defined for a low-impact,
moderate-impact, or high-impact information system. SECURITY OBJECTIVE: Confidentiality, integrity, or availability. [FIPS Publication 199]
SECURITY PLAN: See System Security Plan. SECURITY REQUIREMENTS: Requirements levied on an information system that are derived from
applicable laws, Executive Orders, directives, policies, standards, instructions, regulations, or
procedures, or organizational mission/business case needs to ensure the confidentiality, integrity, and
availability of the information being processed, stored, or transmitted. SENIOR AGENCY INFORMATION SECURITY OFFICER: Official responsible for carrying out the Chief
Information Officer responsibilities under FISMA and serving as the Chief Information Officer's
primary liaison to the agency's authorizing officials, information system owners, and information
system security officers. [44 U.S.C., Sec. 3544]
SYSTEM: See information system. SYSTEM SECURITY PLAN: Formal document that provides an overview of the security requirements for
an information system and describes the security controls in place or planned for meeting those
requirements. [NIST Special Publication 800-18, Revision 1]
TECHNICAL CONTROLS: The security controls (i.e., safeguards or countermeasures) for an information
system that are primarily implemented and executed by the information system through mechanisms
contained in the hardware, software, or firmware components of the system. THREAT: Any circumstance or event with the potential to adversely impact organizational operations
(including mission, functions, image, or reputation), organizational assets, or individuals through an
information system via unauthorized access, destruction, disclosure, modification of information,
and/or denial of service. Also, the potential for a threat-source to successfully exploit a particular
information system vulnerability. [CNSS Instruction 4009 Adapted]
THREAT SOURCE: The intent and method targeted at the intentional exploitation of a vulnerability or a
situation and method that may accidentally trigger a vulnerability. Synonymous with threat agent. USER: Individual or (system) process authorized to access an information system. [CNSS Instruction
4009]
VULNERABILITY: Weakness in an information system, system security procedures, internal controls,
or implementation that could be exploited or triggered by a threat source. [CNSS Instruction 4009
Adapted]
Minimum Security Requirements for Federal Information and Information Systems
3 MINIMUM SECURITY REQUIREMENTS > Specifications for Minimum Security Requirements > AT

Awareness and Training (AT): Organizations must: (i) ensure that managers and users of organizational information systems are made aware of the security risks associated with their activities and of the applicable laws, Executive Orders, directives, policies, standards, instructions, regulations, or procedures related to the security of organizational information systems; and (ii) ensure that organizational personnel are adequately trained to carry out their assigned information security-related duties and responsibilities.
Minimum Security Requirements for Federal Information and Information Systems
3 MINIMUM SECURITY REQUIREMENTS > Specifications for Minimum Security Requirements > AU

Audit and Accountability (AU): Organizations must: (i) create, protect, and retain information system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity; and (ii) ensure that the actions of individual information system users can be uniquely traced to those users so they can be held accountable for their actions.
Minimum Security Requirements for Federal Information and Information Systems
3 MINIMUM SECURITY REQUIREMENTS > Specifications for Minimum Security Requirements > CA

Certification, Accreditation, and Security Assessments (CA): Organizations must: (i) periodically assess the security controls in organizational information systems to determine if the controls are effective in their application; (ii) develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational information systems; (iii) authorize the operation of organizational information systems and any associated information system connections; and (iv) monitor information system security controls on an ongoing basis to ensure the continued effectiveness of the controls.
Minimum Security Requirements for Federal Information and Information Systems
3 MINIMUM SECURITY REQUIREMENTS > Specifications for Minimum Security Requirements > CM

Configuration Management (CM): Organizations must: (i) establish and maintain baseline configurations and inventories of organizational information systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles; and (ii) establish and enforce security configuration settings for information technology products employed in organizational information systems.
Minimum Security Requirements for Federal Information and Information Systems
3 MINIMUM SECURITY REQUIREMENTS > Specifications for Minimum Security Requirements > CP

Contingency Planning (CP): Organizations must establish, maintain, and effectively implement plans for emergency response, backup operations, and post-disaster recovery for organizational information systems to ensure the availability of critical information resources and continuity of operations in emergency situations.
Minimum Security Requirements for Federal Information and Information Systems
3 MINIMUM SECURITY REQUIREMENTS > Specifications for Minimum Security Requirements > IA

Identification and Authentication (IA): Organizations must identify information system users, processes acting on behalf of users, or devices and authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.
Minimum Security Requirements for Federal Information and Information Systems
3 MINIMUM SECURITY REQUIREMENTS > Specifications for Minimum Security Requirements > IR

Incident Response (IR): Organizations must: (i) establish an operational incident handling capability for organizational information systems that includes adequate preparation, detection, analysis, containment, recovery, and user response activities; and (ii) track, document, and report incidents to appropriate organizational officials and/or authorities.
Minimum Security Requirements for Federal Information and Information Systems
3 MINIMUM SECURITY REQUIREMENTS > Specifications for Minimum Security Requirements > MA

Maintenance (MA): Organizations must: (i) perform periodic and timely maintenance on organizational information systems; and (ii) provide effective controls on the tools, techniques, mechanisms, and personnel used to conduct information system maintenance.
Minimum Security Requirements for Federal Information and Information Systems
3 MINIMUM SECURITY REQUIREMENTS > Specifications for Minimum Security Requirements > MP

Media Protection (MP): Organizations must: (i) protect information system media, both paper and digital; (ii) limit access to information on information system media to authorized users; and (iii) sanitize or destroy information system media before disposal or release for reuse.
Minimum Security Requirements for Federal Information and Information Systems
3 MINIMUM SECURITY REQUIREMENTS > Specifications for Minimum Security Requirements > PE

Physical and Environmental Protection (PE): Organizations must: (i) limit physical access to information systems, equipment, and the respective operating environments to authorized individuals; (ii) protect the physical plant and support infrastructure for information systems; (iii) provide supporting utilities for information systems; (iv) protect information systems against environmental hazards; and (v) provide appropriate environmental controls in facilities containing information systems.
Minimum Security Requirements for Federal Information and Information Systems
3 MINIMUM SECURITY REQUIREMENTS > Specifications for Minimum Security Requirements > PL

Planning (PL): Organizations must develop, document, periodically update, and implement security plans for organizational information systems that describe the security controls in place or planned for the information systems and the rules of behavior for individuals accessing the information systems.
Minimum Security Requirements for Federal Information and Information Systems
3 MINIMUM SECURITY REQUIREMENTS > Specifications for Minimum Security Requirements > PS

Personnel Security (PS): Organizations must: (i) ensure that individuals occupying positions of responsibility within organizations (including third-party service providers) are trustworthy and meet established security criteria for those positions; (ii) ensure that organizational information and information systems are protected during and after personnel actions such as terminations and transfers; and (iii) employ formal sanctions for personnel failing to comply with organizational security policies and procedures.
Minimum Security Requirements for Federal Information and Information Systems
3 MINIMUM SECURITY REQUIREMENTS > Specifications for Minimum Security Requirements > RA

Risk Assessment (RA): Organizations must periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational information systems and the associated processing, storage, or transmission of organizational information.
Minimum Security Requirements for Federal Information and Information Systems
3 MINIMUM SECURITY REQUIREMENTS > Specifications for Minimum Security Requirements > SA

System and Services Acquisition (SA): Organizations must: (i) allocate sufficient resources to adequately protect organizational information systems; (ii) employ system development life cycle processes that incorporate information security considerations; (iii) employ software usage and installation restrictions; and (iv) ensure that third-party providers employ adequate security measures to protect information, applications, and/or services outsourced from the organization.
Minimum Security Requirements for Federal Information and Information Systems
3 MINIMUM SECURITY REQUIREMENTS > Specifications for Minimum Security Requirements > SC

System and Communications Protection (SC): Organizations must: (i) monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems; and (ii) employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational information systems.
Minimum Security Requirements for Federal Information and Information Systems
3 MINIMUM SECURITY REQUIREMENTS > Specifications for Minimum Security Requirements > SI

System and Information Integrity (SI): Organizations must: (i) identify, report, and correct information and information system flaws in a timely manner; (ii) provide protection from malicious code at appropriate locations within organizational information systems; and (iii) monitor information system security alerts and advisories and take appropriate actions in response.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Activities

Activities: [NISTIR 7298] An assessment object that includes specific protection-related pursuits or actions supporting an information system that involve people (e.g., conducting system backup operations, monitoring network traffic).
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Adequate Security

Adequate Security: [OMB Circular A-130, Appendix III] Security commensurate with the risk and the magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of information. This includes assuring that systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability, through the use of cost-effective management, personnel, operational, and technical controls.