SP 800-60 is described as assisting federal agencies to do what?

• A. Categorize information and information systems
• B. Define encryption standards
• C. Manage personnel access
• D. Conduct incident response

Answer: (A)

Understanding how to categorize information and information systems for security is what SP 800-60 emphasizes. It provides a method for federal agencies to map data types and system types to security categories (low, moderate, high) based on the potential impact to confidentiality, integrity, and availability. This categorization drives the level of controls required and guides risk management under FISMA. It does not define encryption standards, nor address personnel access management, nor incident response procedures—topics covered by other guidelines.