Categorization of Information Systems
The categorization decision
Categorization answers one question: what is the potential impact on the organization if confidentiality, integrity, or availability of the system and its information is compromised? FIPS 199 defines three impact levels-low (limited adverse effect), moderate (serious adverse effect), and high (severe or catastrophic adverse effect). The system security category is written as SC = {(confidentiality, impact), (integrity, impact), (availability, impact)}. The overall system impact is the high-water mark: the highest impact assigned to any of the three objectives.
Information types and sources
SP 800-60 maps information types to provisional confidentiality, integrity, and availability impacts. The system owner starts with those provisional values, then adjusts for system-specific factors such as aggregation, criticality, and mission dependency. National security systems use CNSSI 1253 instead. Privacy is handled through the confidentiality objective, and a privacy impact assessment may be needed for PII.
Traps
Questions often confuse impact with likelihood or risk: FIPS 199 is impact-only. Another trap is treating the system category as the highest category of every information type without documenting tailoring. Also, a later significant change or new information type can require recategorization. Do not categorize only the hardware; categorize the information and the system.
Worked example
A system holds PII (moderate confidentiality), low-integrity analytics data, and low availability needs. The system category is moderate because the high-water mark is moderate. Rule of thumb: assign impact per objective, take the highest, and record the rationale.