Detections
Analytics
800-53|RA-2
Title
SECURITY CATEGORIZATIONDescription
The organization:Supplemental
Clearly defined authorization boundaries are a prerequisite for effective security categorization decisions. Security categories describe the potential adverse impacts to organizational operations, organizational assets, and individuals if organizational information and information systems are comprised through a loss of confidentiality, integrity, or availability. Organizations conduct the security categorization process as an organization-wide activity with the involvement of chief information officers, senior information security officers, information system owners, mission/business owners, and information owners/stewards. Organizations also consider the potential adverse impacts to other organizations and, in accordance with the USA PATRIOT Act of 2001 and Homeland Security Presidential Directives, potential national-level adverse impacts. Security categorization processes carried out by organizations facilitate the development of inventories of information assets, and along with CM-8, mappings to specific information system components where information is processed, stored, or transmitted.Reference Item Details
Reference: NIST 800-53 - Security and Privacy Controls for Federal Information Systems and Organizations
Related: CM-8,MP-4,RA-3,SC-7
Category: RISK ASSESSMENT
Family: RISK ASSESSMENT
Priority: P1
Baseline Impact: LOW,MODERATE,HIGH
Audit Items
View all Reference Audit Items