Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.4 Step 4: Assign System Security Category > 4.4.1 FIPS 199 Process for System Security Categorization

4.4.1 FIPS 199 Process for System Security Categorization

FIPS 199 recognizes that determining the security category of an information system requires
additional analysis and must consider the security categories of all information types resident on
the information system. For an information system, the potential security impact levels assigned
to each of the respective security objectives (confidentiality, integrity, availability) are the
highest level (i.e., high water mark) for any one of these objectives that has been determined for
the types of information resident on the information system.
Information systems are composed of both computer programs and information. Programs in
execution within an information system (i.e., system processes) facilitate the processing, storage,
and transmission of information and are necessary for the organization to conduct its essential
business functions and operations. These system-processing functions also require protection and
could be subject to security categorization as well. However, in the interest of simplification, it is
assumed that the security categorization of all information types associated with the information
system provide an appropriate worst case potential for the overall information system-thereby
obviating the need to consider the system processes in the security categorization of the
information system. This is in recognition of:
• The fundamental requirement to protect the integrity, availability, and, for key
information such as passwords and encryption keys, the confidentiality of system-level
processing functions and information at the high water mark; and
• The strong interdependence between confidentiality, integrity, and availability.
For this reason, FIPS 199 notes that, while the value (i.e., level) of not applicable can apply to a
security objective for specific information types processed by systems, this value cannot be
assigned to any security objective for an information system. There is a minimum provisional
impact (i.e., low water mark) for a compromise of confidentiality, integrity, and availability for
an information system. This is necessary to protect the system-level processing functions and
information critical to the operation of the information system.
The generalized format for expressing the security category, or SC, of an information system is:
SC information system = {(confidentiality, impact), (integrity, impact), (availability, impact)},
where the acceptable values for potential impact are LOW, MODERATE, or HIGH.
The following examples illustrate the system security categorization process described in FIPS
199.
SYSTEM EXAMPLE 1: An information system used for large acquisitions in a contracting
organization contains both sensitive, pre-solicitation phase contract information and routine
administrative information. The management within the contracting organization determines
that: (i) for the sensitive contract information, the potential impact from a loss of confidentiality
is moderate, the potential impact from a loss of integrity is moderate, and the potential impact
from a loss of availability is low; and (ii) for the routine administrative information (non-
privacy-related information), the potential impact from a loss of confidentiality is low, the
potential impact from a loss of integrity is low, and the potential impact from a loss of
availability is low. The resulting security categories, or SC, of these information types are
expressed as:
SC contract information = {(confidentiality, MODERATE), (integrity, MODERATE), (availability, LOW)}, and
SC administrative information = {(confidentiality, LOW), (integrity, LOW), (availability, LOW)}.
The resulting security category of the information system is expressed as:
SC acquisition system = {(confidentiality, MODERATE), (integrity, MODERATE), (availability, LOW)},
representing the high water mark or maximum potential impact values for each security objective
from the information types resident on the acquisition system.
SYSTEM EXAMPLE 2: A power plant contains a SCADA (supervisory control and data acquisition)
system controlling the distribution f electric power for a large military installation. The SCADA
system contains both real-time sensor data and routine administrative information. The
management at the power plant determines that: (i) for the sensor data being acquired by the
SCADA system, there is no potential impact from a loss of confidentiality, a high potential
impact from a loss of integrity, and a high potential impact from a loss of availability; and (ii) for
the administrative information being processed by the system, there is a low potential impact
from a loss of confidentiality, a low potential impact from a loss of integrity, and a low potential
impact from a loss of availability. The resulting security categories, or SC, of these information
types are expressed as:
SC sensor data = {(confidentiality, NA), (integrity, HIGH), (availability, HIGH)}, and
SC administrative information = {(confidentiality, LOW), (integrity, LOW), (availability, LOW)}.
The resulting security category of the information system is initially expressed as:
SC SCADA system = {(confidentiality, LOW), (integrity, HIGH), (availability, HIGH)},
representing the high water mark or maximum potential impact values for each security objective
from the information types resident on the SCADA system. The management at the power plant
chooses to increase the potential impact from a loss of confidentiality from low to moderate
reflecting a more realistic view of the potential impact on the information system should there be
a security breach due to the unauthorized disclosure of system-level information or processing
functions. The final security category of the information system is expressed as:
SC SCADA system = {(confidentiality, MODERATE), (integrity, HIGH), (availability, HIGH)}.