Categorization of Information Systems
What categorization does
Categorization determines the potential impact of a loss of confidentiality, integrity, and availability on organizational operations, assets, individuals, and other organizations. The result is a system security category expressed as high-water mark across the three objectives, for example a system rated moderate because one objective is moderate even if the others are low. This step drives control selection, so an error here propagates through the entire lifecycle.
The process
Know the sequence: identify the information types processed, stored, or transmitted; map each to provisional impact levels; adjust for national security or special considerations; and assign the overall system category. Information types come from the organization's information type inventory, and impact is assessed at low, moderate, or high. Special factors such as privacy, public safety, or critical infrastructure can raise the category.
Traps to watch
A frequent trap is averaging impact levels instead of using the high-water mark. Another is categorizing the system based on the sensitivity of the hardware rather than the information. Candidates also confuse the impact of a single information type with the overall system category. Finally, remember that categorization is documented and approved, not informal.
Rule of thumb
Categorize the information first, then the system. Worked example: a system stores personnel records (privacy-sensitive, moderate confidentiality), transmits routine status messages (low integrity), and must be available for daily operations (moderate availability). The system is moderate overall, not low, because the high-water mark governs.