Security Categorization RA-2

Risk Assessment · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds RA-2 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Risk Assessment family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

RA-2 (Security Categorization) is about deciding how sensitive a system is and writing that decision down. You look at the information the system processes, stores, and transmits, then rate the impact of losing its confidentiality, integrity, and availability (CIA) — commonly Low, Moderate, or High. That rating drives how much protection the system needs. It is a Low-baseline control.

What good looks like

Categorize the system based on the information it processes, stores, and transmits.
Rate the impact for confidentiality, integrity, and availability (CIA) — commonly Low, Moderate, or High.
Document the categorization and the reasoning behind it in the system security plan.
Have the authorizing official (the person accountable for operating the system) review and approve the result.
Revisit the categorization when the system’s data or mission changes.

Framework mapping

NIST CSF 2.0 — ID.AM-05 — Assets are prioritized based on classification, criticality, resources, and impact on the mission
CIS Controls v8 — Control 3 — Data Protection

How to move it toward Implemented

List what data the lab server actually handles (for example, review key directories with ls -R /srv /var/www plus any databases or app data stores) so the categorization is based on reality.
Decide a Low, Moderate, or High rating for confidentiality, integrity, and availability, and write a sentence of rationale for each.
Record the categorization and rationale in the system security plan, and note who approved it.
Attach that categorization record as hardening evidence on the asset, naming RA-2 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.