FIPS 199 — Security Categorization

Federal Information Processing Standard 199 (Feb 2004): how you rate what a system is worth protecting, straight from the regulation. This drives which control baseline the system must meet.

Where it comes from (the authority)

FIPS 199 (NIST, Feb 2004) — Standards for Security Categorization of Federal Information and Information Systems. The standard itself.
FISMA (Federal Information Security Management Act, 2002; E-Government Act, P.L. 107-347, Title III) — the law that requires agencies to categorize their systems.
40 U.S.C. §11331 — makes NIST FIPS standards mandatory for federal systems (no waiver).
44 U.S.C. §3552 (formerly §3542) — the source of the three security objectives (Confidentiality, Integrity, Availability) quoted below.

Step 1 — the three security objectives

Definitions quoted from FISMA (44 U.S.C.). Every asset is rated against all three.

Objective	Definition (the reg)	A loss means…
Confidentiality	“Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.”	Unauthorized disclosure of information
Integrity	“Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity.”	Unauthorized modification or destruction of information
Availability	“Ensuring timely and reliable access to and use of information.”	Disruption of access to or use of information or a system

Step 2 — the three impact levels

For each objective, ask: if this were lost, how bad? FIPS 199 defines exactly three levels by the potential impact on operations, assets, or individuals. [FIPS 199, Table 1 & §3]

Level	Potential impact	What that looks like (FIPS 199 amplification, paraphrased)
Low	Limited adverse effect	Mission capability noticeably reduced but primary functions still performed; minor asset damage; minor financial loss; minor harm to individuals.
Moderate	Serious adverse effect	Mission effectiveness significantly reduced; significant asset damage; significant financial loss; significant harm to individuals (no loss of life / life-threatening injury).
High	Severe or catastrophic adverse effect	Unable to perform one or more primary functions; major asset damage; major financial loss; severe/catastrophic harm to individuals (loss of life or serious life-threatening injury).

What makes a rationale valid?

The level is not a gut feeling. FIPS 199 sets it by one thing: the magnitude of the adverse effect if that objective is lost. A valid “why” always names a consequence. Ask: if this were lost, how bad is the harm? — measured across four dimensions the standard names:

Mission / operations — can the organization still do its job?
Organizational assets — damage to systems, property, data.
Individuals — harm to people (privacy, safety, even life).
Financial — money lost.

The level is set by the worst of those.

Level	A valid “why” sounds like…
Low	Primary functions still performed, just noticeably less effective; minor asset damage; minor financial loss; minor harm to individuals.
Moderate	Effectiveness significantly reduced; significant asset damage; significant financial loss; significant harm to people — but no loss of life or life-threatening injury.
High	Organization cannot perform one or more primary functions; major asset damage; major financial loss; severe/catastrophic harm — including loss of life or serious injury.

What does NOT count (invalid “excuses”). FIPS 199 is consequence-based, not likelihood-based, so none of these change the level:

✗ “It's unlikely to be attacked” / “nobody would target us.” That's likelihood — it belongs in the risk score (NIST SP 800-30, Likelihood), not the categorization. FIPS 199 assumes the loss happens and asks how bad it is.
✗ “Controls are too expensive / no budget.” Cost of protection is irrelevant to how bad the loss would be.
✗ “It's just a lab / not important to me.” Only the impact of the loss matters, not sentiment.
✗ “We already have a firewall.” Existing controls change residual risk later — not the inherent impact of a loss.

✅ Quick check: if your sentence starts with “because it probably won't…” or “because it would cost…” it's an invalid excuse. If it starts with “because losing this would…” you're on solid FIPS 199 ground.

Using SP 800-60 — information types

You don't rate a system from a blank page. NIST SP 800-60 Vol. II catalogs common information types and gives each a provisional C / I / A impact — a documented starting point you then adjust for your context. Representative examples (provisional / illustrative):

Information type	C	I	A	Why that shape
Public web content / public affairs	Low	Moderate	Low	It's public, so no confidentiality need — but defacement (integrity) matters.
Routine internal administrative	Low	Low	Low	Day-to-day operations; little harm if exposed, changed, or briefly down.
Personally Identifiable Information (PII)	Moderate	Moderate	Low	Privacy harm on disclosure; records must stay accurate.
Financial / payment transactions	Moderate	Moderate	Low	Fraud if modified; sensitive if disclosed.
Law-enforcement / investigative	High	Moderate	Moderate	Disclosure can endanger people or cases.
Life-safety / emergency (E-911, industrial control)	Low	High	High	It must be correct and up — lives depend on it.

Then adjust. SP 800-60's value is a provisional default; you raise or lower it with justification — that's the “Why these levels?” box on the asset.

VM 111 in these terms: its information type is public-facing training web content on an intentionally-vulnerable app (DVWA) holding only synthetic data — closest to public web content: C Low, I Moderate, A Low. That's exactly the categorization on the asset.

Step 3 — write the categorization

FIPS 199 records the result in one line:

SC = { (confidentiality, impact), (integrity, impact), (availability, impact) }

The high-water mark rule. The system's overall level is the highest of its three objective levels — a single High anywhere makes the whole system High. FIPS 199 s.3: the system value can never be lower than the high-water mark of the information it holds.

Step 4 — what it drives (why it matters)

Categorization is step 2 of the NIST Risk Management Framework (RMF, SP 800-37): Categorize → Select. The overall FIPS 199 level picks the NIST SP 800-53B control baseline the system must implement:

Overall level	Baseline selected
Low	SP 800-53 Low baseline
Moderate	SP 800-53 Moderate baseline (Low controls + Moderate additions)
High	SP 800-53 High baseline (Moderate + High additions)

Related: SP 800-60 maps information types to impact levels; SP 800-53 / 53B is the control catalog and baselines (see Controls); FIPS 200 sets the minimum security requirements that the baseline satisfies.

The SP 800-53 baseline — the 188 controls in this catalog

Baselines are cumulative (Low ⊂ Moderate ⊂ High). This teaching catalog tags each control by the lowest baseline it belongs to:

Low baseline = 131 controls · Moderate baseline = 177 (Low + 46 additions) · High baseline = 188 (all). So VM 111 — overall Moderate — must meet the 177 Moderate-baseline controls.

ID	Control	Baseline
Access Control
AC-1	Policy and Procedures	Low
AC-2 Account Management Low What the standard requires (SP 800-53 AC-2) Define and document the account types allowed and specifically prohibited Assign account managers for system accounts Require prerequisites and criteria for group and role membership Specify authorized users, group/role membership, and access authorizations (privileges) per account Require approval by designated personnel before an account is created Create, enable, modify, disable, and remove accounts per documented policy and procedures Monitor the use of accounts Notify account managers when accounts are no longer needed, or a user is terminated, transferred, or their use changes Authorize access based on valid authorization, intended system use, and need-to-know Review accounts for compliance with account-management requirements on a defined frequency Establish a process to reissue shared/group credentials when a member leaves the group Align account management with the personnel termination and transfer processes Moderate-baseline enhancements (why this control is tagged Moderate) AC-2(1): Support account management with automated mechanisms AC-2(2): Automatically remove or disable temporary and emergency accounts after a set period AC-2(3): Disable accounts that are expired, no longer tied to a user, in violation of policy, or inactive beyond a defined period AC-2(4): Automatically audit account creation, modification, enabling, disabling and removal, and notify appropriate personnel No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
AC-3 Access Enforcement Low What the standard requires (SP 800-53 AC-3) Enforce approved authorizations for logical access to information and system resources in accordance with the applicable access control policy (e.g., DAC, RBAC, MAC) No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
AC-4	Information Flow Enforcement	Moderate
AC-5 Separation of Duties Moderate What the standard requires (SP 800-53 AC-5) Identify and document the duties of individuals that require separation Define system access authorizations to support separation of duties No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
AC-6 Least Privilege Moderate What the standard requires (SP 800-53 AC-6) Employ the principle of least privilege — allow only the authorized accesses necessary for users and processes to accomplish assigned tasks Moderate-baseline enhancements (why this control is tagged Moderate) AC-6(1): Authorize access to security functions and security-relevant information explicitly AC-6(5): Restrict privileged accounts to defined personnel/roles AC-6(9): Log the execution of privileged functions AC-6(10): Prevent non-privileged users from executing privileged functions No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
AC-7 Unsuccessful Logon Attempts Low What the standard requires (SP 800-53 AC-7) Enforce a limit of a defined number of consecutive invalid logon attempts by a user during a defined time period Automatically lock the account/node or delay the next prompt when the limit is exceeded No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
AC-8	System Use Notification	Low
AC-10	Concurrent Session Control	High
AC-11	Device Lock	Moderate
AC-12	Session Termination	Moderate
AC-14	Permitted Actions Without Identification or Authentication	Low
AC-17 Remote Access Low What the standard requires (SP 800-53 AC-17) Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed Authorize each type of remote access to the system before allowing connections Moderate-baseline enhancements (why this control is tagged Moderate) AC-17(1): Monitor and control remote access methods via automated mechanisms AC-17(2): Protect the confidentiality and integrity of remote access using encryption No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
AC-18	Wireless Access	Low
AC-19	Access Control for Mobile Devices	Low
AC-20	Use of External Systems	Low
AC-21	Information Sharing	Moderate
AC-22	Publicly Accessible Content	Low
Awareness and Training
AT-1	Policy and Procedures	Low
AT-2 Literacy Training and Awareness Low What the standard requires (SP 800-53 AT-2) Provide security and privacy literacy training at onboarding, on a defined frequency, and when required by system changes Include practical exercises and recognition/reporting of social engineering and insider threat No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
AT-3	Role-based Training	Low
AT-4	Training Records	Low
Audit and Accountability
AU-1	Policy and Procedures	Low
AU-2 Event Logging Low What the standard requires (SP 800-53 AU-2) Identify the event types the system is capable of logging and select those to be logged Coordinate the logging function with other organizational entities Provide a rationale for why the selected event types are adequate Review and update the logged event types on a defined frequency No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
AU-3 Content of Audit Records Low What the standard requires (SP 800-53 AU-3) Ensure audit records contain: what type of event occurred, when, where, the source, the outcome, and the identity of any individuals/subjects associated with the event No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
AU-4	Audit Log Storage Capacity	Low
AU-5	Response to Audit Logging Process Failures	Low
AU-6 Audit Record Review, Analysis, and Reporting Low What the standard requires (SP 800-53 AU-6) Review and analyze system audit records on a defined frequency for indications of inappropriate or unusual activity Report findings to defined personnel/roles No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
AU-7	Audit Record Reduction and Report Generation	Moderate
AU-8	Time Stamps	Low
AU-9 Protection of Audit Information Low What the standard requires (SP 800-53 AU-9) Protect audit information and audit logging tools from unauthorized access, modification, and deletion Alert defined personnel on audit logging process failure No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
AU-10 Non-repudiation High What the standard requires (SP 800-53 AU-10) Provide irrefutable evidence that a given individual/process performed a specific action (so they cannot later deny it) No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
AU-11	Audit Record Retention	Low
AU-12	Audit Record Generation	Low
Assessment, Authorization, and Monitoring
CA-1	Policy and Procedures	Low
CA-2 Control Assessments Low What the standard requires (SP 800-53 CA-2) Select the assessor or assessment team Develop a control assessment plan (controls, procedures, environment, roles) Assess the controls per the plan and produce a control assessment report Provide the results to defined personnel/roles No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
CA-3	Information Exchange	Low
CA-5	Plan of Action and Milestones	Low
CA-6	Authorization	Low
CA-7 Continuous Monitoring Low What the standard requires (SP 800-53 CA-7) Establish a continuous monitoring strategy: metrics to monitor, monitoring/assessment frequencies, ongoing control assessments, response actions, and reporting No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
CA-8 Penetration Testing High What the standard requires (SP 800-53 CA-8) Conduct penetration testing on defined systems/components at a defined frequency No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
CA-9	Internal System Connections	Low
Configuration Management
CM-1	Policy and Procedures	Low
CM-2 Baseline Configuration Low What the standard requires (SP 800-53 CM-2) Develop, document and maintain a current baseline configuration of the system Review and update the baseline on a defined frequency and when required by changes No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
CM-3	Configuration Change Control	Moderate
CM-4	Impact Analyses	Low
CM-5	Access Restrictions for Change	Low
CM-6 Configuration Settings Low What the standard requires (SP 800-53 CM-6) Establish and document configuration settings using security configuration checklists Implement the settings; identify, document and approve any deviations No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
CM-7 Least Functionality Low What the standard requires (SP 800-53 CM-7) Configure the system to provide only essential (mission-necessary) capabilities Prohibit or restrict use of defined functions, ports, protocols, and services No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
CM-8 System Component Inventory Low What the standard requires (SP 800-53 CM-8) Develop and document an inventory of system components Keep the inventory current (accurate, at the level of granularity needed for tracking) No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
CM-9	Configuration Management Plan	Moderate
CM-10	Software Usage Restrictions	Low
CM-11	User-installed Software	Low
CM-12	Information Location	Moderate
Contingency Planning
CP-1	Policy and Procedures	Low
CP-2	Contingency Plan	Low
CP-3	Contingency Training	Low
CP-4	Contingency Plan Testing	Low
CP-6	Alternate Storage Site	Moderate
CP-7	Alternate Processing Site	Moderate
CP-8	Telecommunications Services	Moderate
CP-9 System Backup Low What the standard requires (SP 800-53 CP-9) Conduct backups of user-level and system-level information and system documentation Protect the confidentiality, integrity and availability of backup information No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
CP-10 System Recovery and Reconstitution Low What the standard requires (SP 800-53 CP-10) Provide for the recovery and reconstitution of the system to a known state after a disruption, compromise, or failure No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
Identification and Authentication
IA-1	Policy and Procedures	Low
IA-2 Identification and Authentication (Organizational Users) Low What the standard requires (SP 800-53 IA-2) Uniquely identify and authenticate organizational users Associate that unique identity with processes acting on behalf of those users Moderate-baseline enhancements (why this control is tagged Moderate) IA-2(1): Multi-factor authentication for access to privileged accounts IA-2(2): Multi-factor authentication for access to non-privileged accounts No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
IA-3	Device Identification and Authentication	Moderate
IA-4	Identifier Management	Low
IA-5 Authenticator Management Low What the standard requires (SP 800-53 IA-5) Verify the identity of the individual/role receiving an authenticator before issuing it Manage authenticators: initial content, sufficient strength, change/refresh, protection from disclosure, and changing default authenticators on installation No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
IA-6	Authentication Feedback	Low
IA-7	Cryptographic Module Authentication	Low
IA-8	Identification and Authentication (Non-organizational Users)	Low
IA-11	Re-authentication	Low
IA-12	Identity Proofing	Moderate
Incident Response
IR-1	Policy and Procedures	Low
IR-2	Incident Response Training	Low
IR-3	Incident Response Testing	Moderate
IR-4 Incident Handling Low What the standard requires (SP 800-53 IR-4) Implement an incident-handling capability: preparation, detection and analysis, containment, eradication, and recovery Coordinate handling activities and incorporate lessons learned into procedures No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
IR-5	Incident Monitoring	Low
IR-6 Incident Reporting Low What the standard requires (SP 800-53 IR-6) Require personnel to report suspected incidents within a defined time period Report incident information to defined authorities No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
IR-7	Incident Response Assistance	Low
IR-8 Incident Response Plan Low What the standard requires (SP 800-53 IR-8) Develop an incident response plan (roadmap, structure, roles/responsibilities, metrics, reporting) Distribute the plan, and review/update it on a defined frequency and after changes No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
Maintenance
MA-1	Policy and Procedures	Low
MA-2	Controlled Maintenance	Low
MA-3	Maintenance Tools	Moderate
MA-4	Nonlocal Maintenance	Low
MA-5	Maintenance Personnel	Low
MA-6	Timely Maintenance	Moderate
Media Protection
MP-1	Policy and Procedures	Low
MP-2	Media Access	Low
MP-3	Media Marking	Moderate
MP-4	Media Storage	Moderate
MP-5	Media Transport	Moderate
MP-6 Media Sanitization Low What the standard requires (SP 800-53 MP-6) Sanitize media prior to disposal, release out of organizational control, or reuse, using defined sanitization techniques and procedures No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
MP-7	Media Use	Low
Physical and Environmental Protection
PE-1	Policy and Procedures	Low
PE-2	Physical Access Authorizations	Low
PE-3	Physical Access Control	Low
PE-4	Access Control for Transmission	Moderate
PE-5	Access Control for Output Devices	Moderate
PE-6	Monitoring Physical Access	Low
PE-8	Visitor Access Records	Low
PE-9	Power Equipment and Cabling	Moderate
PE-10	Emergency Shutoff	Moderate
PE-11	Emergency Power	Moderate
PE-12	Emergency Lighting	Low
PE-13	Fire Protection	Low
PE-14	Environmental Controls	Low
PE-15	Water Damage Protection	Low
PE-16	Delivery and Removal	Low
PE-17	Alternate Work Site	Moderate
PE-18	Location of System Components	High
Planning
PL-1	Policy and Procedures	Low
PL-2 System Security and Privacy Plans Low What the standard requires (SP 800-53 PL-2) Develop a system security (and privacy) plan: scope, authorization boundary, operational environment, the controls in place/planned, and roles Review, approve, distribute, and update the plan on changes No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
PL-4	Rules of Behavior	Low
PL-8	Security and Privacy Architectures	Moderate
PL-10	Baseline Selection	Low
PL-11	Baseline Tailoring	Low
Personnel Security
PS-1	Policy and Procedures	Low
PS-2	Position Risk Designation	Low
PS-3	Personnel Screening	Low
PS-4 Personnel Termination Low What the standard requires (SP 800-53 PS-4) On termination: disable system access within a defined time period Revoke authenticators/credentials, retrieve property, and conduct exit procedures No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
PS-5	Personnel Transfer	Low
PS-6	Access Agreements	Low
PS-7	External Personnel Security	Low
PS-8	Personnel Sanctions	Low
PS-9	Position Descriptions	Low
Risk Assessment
RA-1	Policy and Procedures	Low
RA-2	Security Categorization	Low
RA-3 Risk Assessment Low What the standard requires (SP 800-53 RA-3) Conduct a risk assessment: identify threats, vulnerabilities, likelihood and impact Document the results; review/update on a frequency and when changes occur; disseminate No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
RA-5 Vulnerability Monitoring and Scanning Low What the standard requires (SP 800-53 RA-5) Monitor and scan for vulnerabilities on a defined frequency and when new vulnerabilities are identified Analyze reports, remediate legitimate findings, and share information No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
RA-7	Risk Response	Low
RA-9	Criticality Analysis	Moderate
System and Services Acquisition
SA-1	Policy and Procedures	Low
SA-2	Allocation of Resources	Low
SA-3	System Development Life Cycle	Low
SA-4	Acquisition Process	Low
SA-5	System Documentation	Low
SA-8	Security and Privacy Engineering Principles	Low
SA-9	External System Services	Low
SA-10	Developer Configuration Management	Moderate
SA-11	Developer Testing and Evaluation	Moderate
SA-15	Development Process, Standards, and Tools	Moderate
SA-16	Developer-Provided Training	High
SA-17	Developer Security and Privacy Architecture and Design	High
SA-21	Developer Screening	High
SA-22 Unsupported System Components Low What the standard requires (SP 800-53 SA-22) Replace system components when support from the developer/vendor is no longer available Or provide/document an approved plan and mitigations for continued use of unsupported components No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
System and Communications Protection
SC-1	Policy and Procedures	Low
SC-2	Separation of System and User Functionality	Moderate
SC-3 Security Function Isolation High What the standard requires (SP 800-53 SC-3) Isolate security functions from non-security functions (e.g., via hardware/domain separation) No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
SC-4	Information in Shared System Resources	Moderate
SC-5	Denial-of-service Protection	Low
SC-7 Boundary Protection Low What the standard requires (SP 800-53 SC-7) Monitor and control communications at the external boundary and key internal boundaries Connect to external networks only through managed interfaces (boundary protection devices, e.g., firewalls) arranged per a security architecture No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
SC-8 Transmission Confidentiality and Integrity Moderate What the standard requires (SP 800-53 SC-8) Protect the confidentiality and integrity of transmitted information Moderate-baseline enhancements (why this control is tagged Moderate) SC-8(1): Implement cryptographic mechanisms to protect data in transit No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
SC-10	Network Disconnect	Moderate
SC-12 Cryptographic Key Establishment and Management Low What the standard requires (SP 800-53 SC-12) Establish and manage cryptographic keys when cryptography is used: generation, distribution, storage, access, rotation, and destruction No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
SC-13 Cryptographic Protection Low What the standard requires (SP 800-53 SC-13) Determine the cryptographic uses required Implement the required types of cryptography using approved (e.g., FIPS-validated) algorithms No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
SC-15	Collaborative Computing Devices and Applications	Low
SC-17	Public Key Infrastructure Certificates	Moderate
SC-18	Mobile Code	Moderate
SC-20	Secure Name/Address Resolution Service (Authoritative Source)	Low
SC-21	Secure Name/Address Resolution Service (Recursive or Caching Resolver)	Low
SC-22	Architecture and Provisioning for Name/Address Resolution Service	Low
SC-23	Session Authenticity	Moderate
SC-24 Fail in Known State High What the standard requires (SP 800-53 SC-24) Fail to a known-good state, preserving defined system state information in the event of a failure No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
SC-28 Protection of Information at Rest Moderate What the standard requires (SP 800-53 SC-28) Protect the confidentiality and integrity of information at rest Moderate-baseline enhancements (why this control is tagged Moderate) SC-28(1): Implement cryptographic mechanisms to protect information at rest No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
SC-39	Process Isolation	Low
System and Information Integrity
SI-1	Policy and Procedures	Low
SI-2 Flaw Remediation Low What the standard requires (SP 800-53 SI-2) Identify, report and correct system flaws Test software/firmware updates before installation; install within a defined time of release Incorporate flaw remediation into the configuration management process No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
SI-3 Malicious Code Protection Low What the standard requires (SP 800-53 SI-3) Employ malicious-code protection mechanisms at entry/exit points to detect and eradicate malicious code Update the mechanisms and configure scans and response actions No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
SI-4 System Monitoring Low What the standard requires (SP 800-53 SI-4) Monitor the system to detect attacks and indicators of potential attacks, and unauthorized connections Identify unauthorized use of the system; deploy monitoring devices to collect relevant information No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
SI-5	Security Alerts, Advisories, and Directives	Low
SI-6	Security and Privacy Function Verification	High
SI-7	Software, Firmware, and Information Integrity	Moderate
SI-8	Spam Protection	Moderate
SI-10	Information Input Validation	Moderate
SI-11	Error Handling	Moderate
SI-12	Information Management and Retention	Low
SI-16	Memory Protection	Moderate
Supply Chain Risk Management
SR-1	Policy and Procedures	Low
SR-2	Supply Chain Risk Management Plan	Low
SR-3 Supply Chain Controls and Processes Low What the standard requires (SP 800-53 SR-3) Establish supply-chain risk management processes and controls with defined parties Document the selected processes/controls and protect against supply-chain risks No assets linked to this control yet — map it from an asset's detail page to track per-asset status here.
SR-5	Acquisition Strategies, Tools, and Methods	Low
SR-6	Supplier Assessments and Reviews	Moderate
SR-8	Notification Agreements	Low
SR-9	Tamper Resistance and Detection	High
SR-10	Inspection of Systems or Components	Low
SR-11	Component Authenticity	Low
SR-12	Component Disposal	Low

Manage implementation status on the Controls page; map controls to an asset from its detail page.

Worked example — your inventory

Live from the assets you've categorized. The overall level is the high-water mark; the baseline is what it selects on the Controls page.

No asset has a FIPS 199 categorization yet. Set the C / I / A levels on an asset and it appears here as a worked example.

FIPS 199 — Security Categorization

Where it comes from (the authority)

Step 1 — the three security objectives

Step 2 — the three impact levels

What makes a rationale valid?

Using SP 800-60 — information types

Step 3 — write the categorization

Step 4 — what it drives (why it matters)

The SP 800-53 baseline — the 188 controls in this catalog

What the standard requires (SP 800-53 AC-2)

Moderate-baseline enhancements (why this control is tagged Moderate)

What the standard requires (SP 800-53 AC-3)

What the standard requires (SP 800-53 AC-5)

What the standard requires (SP 800-53 AC-6)

Moderate-baseline enhancements (why this control is tagged Moderate)

What the standard requires (SP 800-53 AC-7)

What the standard requires (SP 800-53 AC-17)

Moderate-baseline enhancements (why this control is tagged Moderate)

What the standard requires (SP 800-53 AT-2)

What the standard requires (SP 800-53 AU-2)

What the standard requires (SP 800-53 AU-3)

What the standard requires (SP 800-53 AU-6)

What the standard requires (SP 800-53 AU-9)

What the standard requires (SP 800-53 AU-10)

What the standard requires (SP 800-53 CA-2)

What the standard requires (SP 800-53 CA-7)

What the standard requires (SP 800-53 CA-8)

What the standard requires (SP 800-53 CM-2)

What the standard requires (SP 800-53 CM-6)

What the standard requires (SP 800-53 CM-7)

What the standard requires (SP 800-53 CM-8)

What the standard requires (SP 800-53 CP-9)

What the standard requires (SP 800-53 CP-10)

What the standard requires (SP 800-53 IA-2)

Moderate-baseline enhancements (why this control is tagged Moderate)

What the standard requires (SP 800-53 IA-5)

What the standard requires (SP 800-53 IR-4)

What the standard requires (SP 800-53 IR-6)

What the standard requires (SP 800-53 IR-8)

What the standard requires (SP 800-53 MP-6)

What the standard requires (SP 800-53 PL-2)

What the standard requires (SP 800-53 PS-4)

What the standard requires (SP 800-53 RA-3)

What the standard requires (SP 800-53 RA-5)

What the standard requires (SP 800-53 SA-22)

What the standard requires (SP 800-53 SC-3)

What the standard requires (SP 800-53 SC-7)

What the standard requires (SP 800-53 SC-8)

Moderate-baseline enhancements (why this control is tagged Moderate)

What the standard requires (SP 800-53 SC-12)

What the standard requires (SP 800-53 SC-13)

What the standard requires (SP 800-53 SC-24)

What the standard requires (SP 800-53 SC-28)

Moderate-baseline enhancements (why this control is tagged Moderate)

What the standard requires (SP 800-53 SI-2)

What the standard requires (SP 800-53 SI-3)

What the standard requires (SP 800-53 SI-4)

What the standard requires (SP 800-53 SR-3)

Worked example — your inventory