thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Security Categorization

Process of determining the impact level of a system or information based on potential harm from loss of CIA.

Definition

Security categorization uses FIPS 199 and SP 800-60 for federal systems, and analogous impact assessments in private sector frameworks. It drives the selection of control baselines and the rigor of assessment. CNSSI 1253 provides a variation for national security systems without using a single high-water mark.

Example

A public website is categorized low confidentiality, moderate integrity, moderate availability.

Exam tip

National security systems use CNSSI 1253 and keep separate C, I, A values rather than a single high-water mark.

Related terms