FIPS 199 is used to do what?

• A. Identify and categorize federal information systems
• B. Define encryption standards
• C. Set password requirements
• D. Describe access control models

Answer: (A)

FIPS 199 focuses on security categorization of federal information systems. It provides a framework to identify what information and systems exist and to classify them based on the potential impact of a security breach across confidentiality, integrity, and availability. The result is a categorization into low, moderate, or high impact, which then drives the selection of appropriate security controls in later guidance. This is why it’s used to identify and categorize federal information systems. It isn’t about encryption standards (that’s the realm of FIPS 140-series), password requirements, or described access control models, which are covered in other standards and guidelines.