Lion Cipher Lab

Categorize a system with FIPS 199 (NIST RMF Step 1)

• GRC / Compliance
• Intermediate
• ~60 min
• Free · no account required

Why it matters

Before anyone can secure a system properly, they have to answer one question: how much protection does THIS system actually need? A public blog and a system holding medical records do not get the same treatment, and guessing wastes money on one and gets people hurt on the other. FIPS 199 is the US government's official, decades-old answer to that question, and 'categorization' is the very first move in the NIST Risk Management Framework that every federal system, and most serious private programs, run on. Get the categorization wrong and everything downstream — which controls you must…

What you'll learn

• FIPS 199 security categorization
• Rating confidentiality, integrity, and availability impact
• Applying the high-water mark
• Using NIST SP 800-60 information types
• NIST Risk Management Framework (RMF) Step 1

Steps in this lab

1. The one question this whole lab answers
2. Where this sits: the Risk Management Framework
3. The three things that can go wrong (the security objectives)
4. The three levels of 'how bad' (the impact levels)
5. Pick a real system and list what information it holds
6. Rate each information type — and use SP 800-60 as your cheat sheet
7. Roll the information types up into the system — the high-water mark (part 1)
8. Reach the overall impact level — the high-water mark (part 2)
9. Write the categorization statement (your deliverable and template)
10. What you produced, and the step it unlocks

Open the full interactive lab →