thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

RMF Categorize Step

RMF step that determines a system's security category based on impact of loss of confidentiality, integrity, and availability.

Definition

Using FIPS 199 and SP 800-60, the system owner identifies information types and assigns low, moderate, or high impact for each security objective. The overall categorization follows the high-water mark and is documented in the system security plan. The authorizing official or designee reviews and approves it.

Example

A payroll system processing PII is categorized moderate for confidentiality and integrity, low for availability, so overall moderate.

Exam tip

Categorization drives baseline selection; it must happen before Select.

Related terms