The National Institute of Standards and Technology (NIST) Special Publication 800-60, "Guide for Mapping Types of Information and Information Systems to Security Categories," provides a framework for categorizing information systems based on their potential impact on an organization. This guide is particularly relevant for federal agencies and contractors that must comply with the Federal Information Security Management Act (FISMA) and the Federal Information Processing Standard (FIPS) 199.
Understanding FIPS 199 and NIST 800-60
FIPS 199, "Standards for Security Categorization of Federal Information and Information Systems," requires federal agencies to categorize their information systems based on the potential impact of a security breach. NIST 800-60 provides a guide for mapping types of information and information systems to security categories.
Security Categorization Process
The security categorization process involves three primary steps:
- Identify the information types: Determine the types of information processed, stored, or transmitted by the system.
- Determine the security impact: Assess the potential impact of a security breach on the confidentiality, integrity, and availability of the information.
- Assign a security category: Based on the potential impact, assign a security category to the system.
Security Categories
FIPS 199 defines three security categories:
- Low-Impact: A security breach would have a limited impact on the organization.
- Moderate-Impact: A security breach would have a moderate impact on the organization.
- High-Impact: A security breach would have a significant impact on the organization.
Mapping Information Types to Security Categories
NIST 800-60 provides a table that maps information types to security categories. The table considers the potential impact of a security breach on the confidentiality, integrity, and availability of the information.
| Information Type | Security Category |
|---|---|
| Public Information | Low-Impact |
| Sensitive Information | Moderate-Impact |
| Classified Information | High-Impact |
System Categorization Template
A system categorization template can help organizations streamline the security categorization process. The template should include the following information:
- System Name: The name of the system being categorized.
- Information Types: The types of information processed, stored, or transmitted by the system.
- Security Impact: The potential impact of a security breach on the confidentiality, integrity, and availability of the information.
- Security Category: The assigned security category based on the potential impact.
Example of a System Categorization Template
| System Name | Information Types | Security Impact | Security Category |
|---|---|---|---|
| Employee Database | Sensitive Information | Moderate-Impact | Moderate |
| Public Website | Public Information | Low-Impact | Low |
| Financial System | Classified Information | High-Impact | High |
Benefits of System Categorization
System categorization provides several benefits, including:
- Improved risk management: By understanding the potential impact of a security breach, organizations can better manage risk.
- Enhanced security: System categorization helps organizations prioritize security controls and allocate resources effectively.
- Compliance: System categorization is a requirement for federal agencies and contractors that must comply with FISMA and FIPS 199.
Conclusion
System categorization is a critical process for federal agencies and contractors that must comply with FISMA and FIPS 199. By understanding the potential impact of a security breach, organizations can better manage risk, enhance security, and ensure compliance. A system categorization template can help organizations streamline the process and ensure that all relevant information is considered.
Gallery of NIST 800-60 and FIPS 199 Resources
What is FIPS 199?
+FIPS 199 is a federal standard that requires federal agencies to categorize their information systems based on the potential impact of a security breach.
What is NIST 800-60?
+NIST 800-60 is a guide for mapping types of information and information systems to security categories.
Why is system categorization important?
+System categorization is important because it helps organizations manage risk, enhance security, and ensure compliance with federal standards.