NIST SP 800-60 Guides Categorization of Federal Information Systems

The National Institute of Standards and Technology’s SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories, gives federal agencies a method for mapping the information handled by a system to security categories. It applies to federal information systems other than national security systems and builds on FIPS 199, which defines security categorization objectives and impact levels. For contractors supporting civilian federal systems, the guide is relevant to the agency’s security-control decisions: a sound categorization helps establish the impact levels that inform control selection and broader risk-management work.

The publication was issued in response to responsibilities assigned to NIST by the Federal Information Security Management Act (FISMA), Title III of the E-Government Act of 2002. NIST was tasked with developing standards for categorizing information and systems, as well as guidelines recommending the types of information and systems included in each category. FIPS 199 addresses the standards task; SP 800-60 addresses the guidance task. The guidance also draws on the Federal Enterprise Architecture (FEA) reference model work of the Office of Management and Budget Federal Enterprise Architecture Program Management Office, including the October 2007 FEA Consolidated Reference Model Document, Version 2.3.

For acquisition and delivery teams, SP 800-60 is a planning and implementation reference rather than a new procurement action. Contractors can use its information-type mappings and provisional impact levels to prepare categorization recommendations, but should not assume those provisional assignments are the final agency determination. The source advises identifying applicable information types, reviewing the provisional levels, confirming final levels with appropriate agency officials, and applying the system’s high-water mark so the overall categorization reflects the highest relevant impact level. Those steps can help align proposed technical safeguards and security-control implementation with agency decisions.

The current final guidance is Revision 1, published in August 2008, which superseded the June 2004 version. The source reports that a Revision 2 working draft is proposed and should be monitored, but does not identify it as a final requirement. Contractors should therefore use final Revision 1 for current work and coordinate with agency stakeholders about any applicable updates or direction. The publication is organized into a basic guideline and appendices: Volume I covers the role of categorization, FIPS 199 objectives and impact levels, and the categorization process; Volume II includes provisional impact-level assignments and their rationale for management/support and mission-based information, as well as legislative and executive sources on information sensitivity or criticality.

• Scope: SP 800-60 applies to federal information systems other than national security systems; it assumes familiarity with FIPS 199.
• Procurement relevance: Contractors supporting federal systems can use the guide to inform agency security-control selection and system risk-management activities.
• Categorization workflow: Identify the information types handled, consult provisional impact levels, and bring proposed determinations to the appropriate agency officials for confirmation.
• System-level impact: Apply the system’s high-water mark so categorization accounts for the highest relevant impact level among its information types.
• Current baseline: Use final Revision 1, published in August 2008 and superseding the June 2004 version, for current work unless agency direction specifies otherwise.
• Revision tracking: The source describes Revision 2 as a working draft; monitor its status, but do not treat it as a final requirement based on this signal.
• Document structure: Volume I covers categorization concepts, FIPS 199 impact levels, and process steps; Volume II contains appendices, including provisional levels and rationale.
• FEA context: The guide draws on the OMB FEA Program Management Office’s October 2007 Consolidated Reference Model, Version 2.3.
• Legal context: SP 800-60 responds to the FISMA-related NIST guidance task; FIPS 199 addresses the associated standards task.