FIPS 199: Security Categorization and the High-Water Mark

FIPS 199 security categorization and impact levels are the federal method for rating how much harm a security breach would cause to an information system, using three objectives (confidentiality, integrity, and availability) and three impact levels (low, moderate, and high). The rating you assign drives which security controls apply, whether the system can receive an Authorization to Operate, and how the system is treated under FedRAMP if it lives in the cloud.¹

The Three Security Objectives Being Rated

Every piece of federal data covered by the standard is evaluated against three objectives drawn from the statutory definition of information security at 44 U.S.C. § 3552.²

Confidentiality is keeping information accessible only to authorized people. A breach means restricted records reach someone who should not have them.
Integrity is protecting data from unauthorized changes or destruction, including the ability to verify who created or approved something.
Availability is making sure authorized users can reach the system and data when they need to. When a portal goes dark, that is a loss of availability.

The three objectives are rated independently. A public-facing website may have no meaningful confidentiality concern because the data is already public, while tampering with the same data could carry serious integrity and availability impacts. Rating each objective separately is what lets the standard reflect that difference.

What Low, Moderate, and High Mean

For each objective, the agency assigns one of three impact levels. The definitions come from the standard itself.¹

Low means a loss would cause a limited adverse effect on operations, assets, or individuals. Minor disruptions, a small financial cost the agency can absorb, slight reputational damage.
Moderate means the effect would be serious. Operations significantly degraded, real harm to individuals short of life-threatening, and losses substantial enough to require dedicated remediation. Most federal cloud systems land here.
High means severe or catastrophic harm. Loss of life, life-threatening injuries, or the complete inability of the agency to carry out its primary mission. Law enforcement, emergency services, and financial infrastructure systems often sit at this level.

The difference between adjacent levels is not cosmetic. Moving a system from moderate to high can add over a hundred additional security controls the agency has to implement and maintain.

How an Information Type Gets Rated

Categorization starts at the information-type level, not the system level. An agency inventories the kinds of data it handles (payroll records, case files, procurement documents, public statistics, and so on) and assigns each type a separate impact rating for confidentiality, integrity, and availability.¹

The standard uses a structured notation:

SC information type = {(confidentiality, impact), (integrity, impact), (availability, impact)}

A public information record might look like: SC public info = {(confidentiality, NA), (integrity, MODERATE), (availability, MODERATE)}. That “Not Applicable” designation can only be used for confidentiality, and only at the information-type level. It cannot be carried up to a system-level rating.¹

Agencies don’t invent these ratings from scratch. NIST Special Publication 800-60 catalogs common federal information types with recommended impact levels; Volume I covers the methodology and Volume II contains the appendices with the recommendations and rationale.³⁴ Agencies can adjust when context justifies it, but the starting point is data-driven.

How the System Rating Is Set: The High-Water Mark

A federal information system almost always processes more than one information type. To produce a single system rating, the agency takes the highest impact value assigned to each security objective across every information type in the system.¹

This is the high-water mark principle, and it is the most consequential mechanic in the standard. If a system handles ten information types and nine rate low for confidentiality but one rates high, the whole system’s confidentiality rating is high. A system is only as secure as its most sensitive data requires.

There is also a floor. Even if every information type carries an “NA” for confidentiality, the system still receives at least a low for confidentiality, because every system has a baseline need to protect the processing functions and operational data that keep it running.¹ No federal system covered by FIPS 199 can be categorized below {(confidentiality, LOW), (integrity, LOW), (availability, LOW)}.

Why the Rating Matters

FIPS 199 categorization is the first step in the NIST Risk Management Framework, and everything downstream depends on it.⁵ FIPS 200 translates the categorization into minimum security requirements, and the agency then selects a tailored set of controls from NIST SP 800-53.⁶

SP 800-53B defines three control baselines, one per impact level. For baseline selection, a system counts as high-impact if any one of its three objectives is rated high; moderate if at least one is moderate and none is high; and low only if all three are low.⁷ Miscategorize on the low side and the system runs with weaker controls than the data requires, which shows up in audits and blocks the Authorization to Operate. Miscategorize on the high side and the agency spends time and money on controls it doesn’t need.

FedRAMP Uses the Same Levels

Cloud service offerings that handle federal data are categorized under the same framework through the Federal Risk and Authorization Management Program. Providers pursue low, moderate, or high impact authorization based on the sensitivity of the government data the service will process, store, or transmit.⁸

The moderate baseline accounts for roughly 80 percent of FedRAMP-authorized cloud applications. High-impact authorization is reserved for systems handling law enforcement, emergency services, financial, and health data where a breach could threaten lives or cause financial ruin. FedRAMP also offers a tailored low-impact SaaS baseline for simpler applications that store no personally identifiable information beyond login credentials.⁸ For a cloud vendor, picking the wrong FIPS 199 level means pursuing the wrong authorization path.

What FIPS 199 Does Not Cover

The standard applies only to federal information and information systems that are not national security systems. Classified information, systems handling data protected under Executive Order 12958 (as amended), and systems covered by the Atomic Energy Act sit outside its scope and follow separate frameworks managed by the intelligence community and the Department of Defense.¹

FIPS 199 also stops at defining the problem. It answers how bad a breach would be; it does not prescribe specific controls. That job belongs to FIPS 200 and SP 800-53. Private-sector organizations sometimes adopt FIPS 199 as a voluntary risk-assessment tool, but compliance is legally mandatory only for federal executive branch agencies and their contractors handling federal data.

1
National Institute of Standards and Technology. FIPS Publication 199 – Standards for Security Categorization of Federal Information and Information Systems
2
Office of the Law Revision Counsel. 44 USC 3552 – Definitions
3
National Institute of Standards and Technology. NIST Special Publication 800-60 Volume I Revision 1 – Guide for Mapping Types of Information and Information Systems to Security Categories
4
National Institute of Standards and Technology. NIST Special Publication 800-60 Volume II Revision 1 – Guide for Mapping Types of Information and Information Systems to Security Categories
5
NIST Computer Security Resource Center. NIST RMF Categorize Step FAQs
6
National Institute of Standards and Technology. FIPS Publication 200 – Minimum Security Requirements for Federal Information and Information Systems
7
National Institute of Standards and Technology. NIST Special Publication 800-53B – Control Baselines for Information Systems and Organizations
8
FedRAMP. Understanding Baselines and Impact Levels in FedRAMP