Categorization is the process of selecting an Impact Level according to FIPS 199, which is a public law and must be adhered to. FIPS 199 sets three impact levels of HIGH, MODERATE and LOW. They are selected according to a consideration of the potential impact level on an organization if a security event jeopardizes the information system. The potential impact is evaluated in three categories:
- Confidentiality – A loss of confidentiality is the unauthorized disclosure of information
- Integrity – A loss of integrity is the unauthorized modification or destruction of information
- Availability – A loss of availability is the disruption of access to or use of information or an information system
The potential impact level for disruption must be considered for both the information AND the information system. The overall impact level is set by the highest level found in the three categories.
Once the impact level has been determined, the appropriate baseline of security is automatically selected from NIST 800-53. There are three baseline levels corresponding to the three FIPS impact levels and each baseline selects a subset of 800-53 controls. There are currently 171 total controls in 800-53. Eight of the controls are not considered to be very high priority in most cases and are not selected for any of the three baselines.
[note that these may be used later as “supplementary controls”]
- For the HIGH impact level baseline, 163 controls are selected.
- For the MODERATE impact level baseline, 152 controls are selected.
- For the LOW impact level baseline, 99 controls are selected.
FIPS Publications – [NIST]