FIPS 199 is the federal standard that requires every agency to categorize each of its information types and information systems as low, moderate, or high impact based on how much harm a security failure would cause. Published by the National Institute of Standards and Technology in February 2004 under the authority of the Federal Information Security Management Act, it gives the federal government a single language for measuring information security risk and sets the starting point for every other security decision that follows.1National Institute of Standards and Technology. FIPS 199 – Standards for Security Categorization of Federal Information and Information Systems Compliance is mandatory. Agencies do not get to opt out or substitute their own classification schemes.
The standard applies to all federal information and all federal information systems, with two exclusions: classified national security information protected under executive order, and national security systems as defined by statute.2Federal Register. Announcing Approval of FIPS Publication 199 – Standards for Security Categorization of Federal Information and Information Systems Anything else the federal government handles falls within its scope.
The Three Security Objectives
FIPS 199 evaluates information against three security objectives drawn directly from FISMA. These are the specific angles from which a potential failure gets measured.
- Confidentiality is the preservation of authorized restrictions on access and disclosure. A failure means someone who should not see the data gets access to it: personal privacy information, proprietary procurement details, pre-decisional policy documents.
- Integrity is protection against improper modification or destruction, including making sure records are authentic and actions cannot be denied after the fact. A failure means data has been altered or destroyed without authorization.
- Availability is timely, reliable access to information. A failure means the system is down or too slow to use when it matters.
The Three Impact Levels
For each of the three objectives, an agency assigns one of three impact levels based on the worst realistic outcome of a failure.
- Low means a security breach would cause a limited adverse effect: minor degradation of mission capability, minor financial loss, or minor harm to individuals.
- Moderate means a serious adverse effect. The agency might lose the ability to perform some primary functions effectively, suffer significant financial loss, or cause significant harm to individuals, but not loss of life or life-threatening injuries.
- High means a severe or catastrophic adverse effect: total inability to perform critical mission functions, major financial loss, or severe harm to individuals including loss of life.
If a system failure could get someone killed, that is a high categorization. Law enforcement databases, emergency services, and critical infrastructure controls sit there for that reason.2Federal Register. Announcing Approval of FIPS Publication 199 – Standards for Security Categorization of Federal Information and Information Systems
How an Agency Actually Categorizes a System
The process runs in a specific order. An agency first identifies the types of information a system handles, rates each type against the three objectives, and then rolls the ratings up into a single system-level category.
Identifying Information Types
NIST Special Publication 800-60 catalogs hundreds of federal information types organized by government function, from budget formulation and tax management to intelligence operations and disaster monitoring. Each type comes with recommended provisional impact levels that agencies can adjust based on their specific context. Key asset and critical infrastructure protection information, for example, is rated high across all three objectives; routine general information is rated low across the board.3National Institute of Standards and Technology. NIST Special Publication 800-60 Volume II Revision 1
Rating Each Type
Every information type is rated separately for confidentiality, integrity, and availability. The result is written as a formula:
SC = {(confidentiality, impact), (integrity, impact), (availability, impact)}
Sensitive contract information in a procurement system might be rated:
SC contract information = {(confidentiality, moderate), (integrity, moderate), (availability, low)}
Routine administrative information on the same system might be:
SC administrative information = {(confidentiality, low), (integrity, low), (availability, low)}1National Institute of Standards and Technology. FIPS 199 – Standards for Security Categorization of Federal Information and Information Systems
The Not Applicable Exception
When rating individual information types, confidentiality can be marked “Not Applicable” if the agency has already determined the information is publicly releasable. Public information might be rated:
SC public information = {(confidentiality, NA), (integrity, moderate), (availability, moderate)}
“Not Applicable” cannot be used at the system level, however. Even a system hosting entirely public information has some minimum confidentiality concern, because the system itself contains processing functions and operational data that need protection.1National Institute of Standards and Technology. FIPS 199 – Standards for Security Categorization of Federal Information and Information Systems
The High-Water Mark
When a system processes multiple information types, its system-level category takes the highest impact value assigned across all information types for each objective. This is the high-water mark principle, and it is deliberately conservative. Using the procurement example, a system holding both contract information (moderate/moderate/low) and administrative information (low/low/low) ends up at:
SC acquisition system = {(confidentiality, moderate), (integrity, moderate), (availability, low)}
The moderate ratings on the contract data pull the whole system up. You cannot protect half a system, so if sensitive data lives on it, the entire system gets the stronger safeguards.1National Institute of Standards and Technology. FIPS 199 – Standards for Security Categorization of Federal Information and Information Systems
What the Category Actually Determines
FIPS 199 categorization is the first step in the NIST Risk Management Framework. The framework runs: categorize, select controls, implement controls, assess, authorize, and monitor. Nothing else moves forward until categorization is complete, which is why an inaccurate assessment cascades errors through every step that follows.4NIST Computer Security Resource Center. Risk Management Framework – Categorize Step
Once the category is set, FIPS 200 defines the minimum security requirements for the system based on that impact level.5National Institute of Standards and Technology. Minimum Security Requirements for Federal Information and Information Systems The specific controls to meet those requirements come from NIST Special Publication 800-53, which organizes its catalog of security and privacy controls into baselines matched to the low, moderate, and high impact levels.6National Institute of Standards and Technology. NIST Special Publication 800-53 Revision 5 – Security and Privacy Controls for Information Systems and Organizations Higher baselines require more controls, more rigorous testing, and more extensive documentation. A system categorized as high impact will carry a substantially larger compliance load than one categorized as low.
FIPS 199 in Cloud Services and FedRAMP
The Federal Risk and Authorization Management Program applies FIPS 199 to cloud services. Providers seeking to host federal data categorize their offerings using the same standard, and FedRAMP organizes its authorization baselines around the same low, moderate, and high impact levels.7FedRAMP. Understanding Baselines and Impact Levels in FedRAMP
Moderate-impact systems account for roughly 80 percent of cloud offerings that receive FedRAMP authorization, covering scenarios where a breach would cause serious but not catastrophic harm. High-impact authorization is reserved for the most sensitive unclassified data, including law enforcement, financial, and health systems where a failure could threaten lives or cause financial ruin. FedRAMP also offers a streamlined LI-SaaS baseline for low-risk software-as-a-service products that do not store personal information beyond basic login credentials.
Providers use the FedRAMP FIPS 199 categorization template alongside NIST SP 800-60 to map their data types to impact levels, implement the corresponding control baseline, and undergo independent assessment by a FedRAMP-accredited third-party organization before receiving authorization.7FedRAMP. Understanding Baselines and Impact Levels in FedRAMP