Categorization Pressure on a Public-Facing PII Portal
An agency is preparing its RMF package for a licensing portal serving 1.8 million licensees. The portal holds names, addresses, dates of birth, license numbers, and the last four digits of SSNs; it does not store full SSNs or payment card data. The system validates eligibility against an internal enforcement database and must be available during a 45-day renewal window. The CIO has asked the security team to categorize confidentiality as Low because data at rest is AES-256 encrypted, access requires phishing-resistant MFA, and the portal has never had a breach. The system owner wants to finish the FIPS 199 worksheet this week so the team can select controls and begin the assessment. A privacy officer notes that the last PIA is four years old and predates a new mobile feature that displays license status. The AO has not yet been briefed.
1. What security category should the team document for confidentiality, integrity, and availability, and how should the privacy officer's concern be reflected? Explain the effect of the CIO's controls argument.
Read the worked answer
Apply FIPS 199 to the potential impact of a loss, not to the probability of loss after controls. The portal holds PII for 1.8 million people, including DOB and SSN4, which is enough to support identity-verification fraud and to cause serious reputational and individual harm. Confidentiality should therefore be documented as Moderate. Integrity should be Moderate because license eligibility and enforcement data affect whether someone is licensed and can create public-safety and due-process consequences. Availability is at least Moderate if missing the 45-day renewal window would disrupt a statutory mission and a large population; a Low rating needs evidence that an outage would have only a limited adverse effect. The overall security category is the high-water mark: Moderate. Privacy is not a separate FIPS 199 triad letter; the privacy impact is considered in the confidentiality impact. The stale PIA is a separate action: update it for the mobile feature and use it to inform control selection. Encryption and MFA do not lower the category; they are controls selected to meet the Moderate baseline and reduce residual risk.
2. The CIO proposes to reduce the baseline from Moderate to Low by applying encryption and MFA as compensating controls. What should you advise, and what documentation should capture the decision?
Read the worked answer
Advise against reducing the baseline. FIPS 200 requires minimum security requirements commensurate with the security category; SP 800-53B baseline selection starts from the Moderate baseline. Tailoring can scope out controls that are not applicable, choose compensating controls, and set parameters, but it cannot convert a Moderate system into a Low system. The encryption and MFA are evidence for how the organization meets confidentiality controls, not a reason to change impact. Document the rationale in the SSP: categorization worksheet, boundary, data types, baseline, scoping decisions, compensating controls, and residual risk. The AO can accept residual risk or impose conditions; the AO cannot simply waive the categorization. If the organization believes the data is no longer PII because of encryption, test that claim against the definition and re-identification risk; encryption at rest does not change who can see plaintext through the application. Keep the Moderate baseline, tailor, assess, and use the risk assessment to prioritize.
3. The team also plans to add the mobile status feature and the enforcement database query. What RMF activities and boundary considerations are triggered?
Read the worked answer
The new mobile feature and the enforcement query change the data flows and the boundary. Update the SSP boundary and data-flow diagrams, identify the enforcement database as an interconnected system, and document the interconnection with an ISA or MOU that covers purpose, data elements, authentication, logging, and incident notification. Add the mobile app to the privacy analysis and check whether it introduces new collection or display of PII. If the system is not yet authorized, these are design changes to assess before the initial ATO; if it is already operating, treat them as a significant change and follow the AO significant-change process. Update the inventory, control implementation, and assessment scope. Do not let the team finish the worksheet without resolving the boundary. The evidence should show the AO saw the updated categorization, privacy analysis, and interconnection risk before authorizing.