NIST 800-53 REV 5 • RISK ASSESSMENT
RA-2 — Security Categorization
Categorize the system and information it processes, stores, and transmits; Document the security categorization results, including supporting rationale, in the security plan for the system; and Verify that the authorizing official or authorizing official designated representative reviews and approves the security categorization decision.
Supplemental Guidance
Security categories describe the potential adverse impacts or negative consequences to organizational operations, organizational assets, and individuals if organizational information and systems are compromised through a loss of confidentiality, integrity, or availability. Security categorization is also a type of asset loss characterization in systems security engineering processes that is carried out throughout the system development life cycle. Organizations can use privacy risk assessments or privacy impact assessments to better understand the potential adverse effects on individuals. [CNSSI 1253](#4e4fbc93-333d-45e6-a875-de36b878b6b9) provides additional guidance on categorization for national security systems. Organizations conduct the security categorization process as an organization-wide activity with the direct involvement of chief information officers, senior agency information security officers, senior agency officials for privacy, system owners, mission and business owners, and information owners or stewards. Organizations consider the potential adverse impacts to other organizations and, in accordance with [USA PATRIOT](#13f0c39d-eaf7-417a-baef-69a041878bb5) and Homeland Security Presidential Directives, potential national-level adverse impacts. Security categorization processes facilitate the development of inventories of information assets and, along with [CM-8](#cm-8) , mappings to specific system components where information is processed, stored, or transmitted. The security categorization process is revisited throughout the system development life cycle to ensure that the security categories remain accurate and relevant.
Practitioner Notes
Security categorization is the process of determining how much protection a system needs based on the types of information it processes and the potential impact of a security breach. This drives all subsequent security decisions.
Example 1: Use FIPS 199 to categorize each system by evaluating the potential impact (low, moderate, high) to confidentiality, integrity, and availability. A payroll system storing SSNs would be moderate or high for confidentiality. A public website would be low for confidentiality but potentially moderate for availability.
Example 2: Document the categorization in each system's security plan using NIST SP 800-60 as a guide for mapping information types to impact levels. Review the categorization whenever the system's function, data types, or user base changes significantly. The categorization determines the baseline set of controls you must implement.