The Legacy Billing System That Cannot Be Categorized
A federal agency operates a 22-year-old mainframe billing system that processes 1.4 million transactions nightly. The system owner proposes categorizing it as Moderate confidentiality, Low integrity, Low availability because 'the data is mostly internal.' However, the system feeds disbursement files directly to Treasury, and a two-hour outage last quarter triggered a manual reconciliation costing $340,000. The system has no documented data flow to a downstream analytics platform that ingests the same records. The security team has flagged that the system handles taxpayer identification numbers in bulk. The system owner argues that because the mainframe is physically secured and access is limited to 12 operators, the impact ratings should be reduced. The authorizing official has asked for a defensible categorization before the upcoming assessment cycle.
1. Evaluate the system owner's proposed categorization. What is wrong with the reasoning, and what should the provisional impact ratings be across all three security objectives?
Read the worked answer
The owner's proposal fails on several counts. First, confidentiality cannot be Low: the system processes taxpayer identification numbers in bulk, and unauthorized disclosure of PII at that scale produces serious or severe harm to individuals and to the agency's reputation. The physical-security argument is a control consideration, not an impact consideration - impact ratings describe the consequence of a loss event, not the likelihood given existing safeguards. Conflating the two is a classic categorization error.
Second, integrity cannot be Low. The system produces disbursement files consumed by Treasury; corrupted records mean incorrect payments, which is a serious-to-severe integrity impact regardless of how 'internal' the data feels.
Third, availability cannot be Low. A two-hour outage forced $340,000 in manual reconciliation, demonstrating at minimum a Moderate availability impact, arguably High given the financial and mission consequences.
A defensible provisional categorization is Moderate/High confidentiality, High integrity, Moderate-to-High availability, with the overall system categorization set to the high-water mark. The owner should also document the undocumented data flow to the analytics platform, since that downstream ingestion expands the impact surface and must be reflected in the boundary definition.
2. The system owner wants to lower ratings because compensating controls exist. Explain how compensating controls should factor into categorization versus control selection, and what artifact the owner should produce.
Read the worked answer
Categorization (the FIPS 199-style impact analysis) is a statement about potential harm if confidentiality, integrity, or availability is compromised. It is deliberately control-agnostic: you assess impact as though no safeguards existed, because the rating drives the baseline that determines how much protection the system deserves. Compensating controls belong in the control selection and tailoring phase, where they can justify scoping decisions, not in the impact rating itself.
If the owner lowered impact ratings to reflect existing physical security, the system would be baselined at a lower tier, and the very controls producing that security could later be removed without triggering a re-categorization - a ratchet-down failure mode. The correct artifact is a categorization document with rationale that: (1) states each objective's impact rating with supporting justification tied to the PII volume, Treasury disbursement dependency, and the documented outage cost; (2) records the overall high-water-mark categorization; (3) lists the compensating controls separately as inputs to tailoring; and (4) is reviewed and approved by the authorizing official before baseline selection begins. The owner may also document assumptions and constraints, but assumptions do not override impact evidence.