What is the purpose of FIPS 200?

• A. Standards for categorizing information and information systems
• B. Standards for encryption key lengths
• C. Standards for incident handling and response
• D. Standards for auditing and accountability

Answer: (A)

FIPS 200 is about establishing a uniform approach to protect federal information by tying protection needs to how information and information systems are categorized by impact. The main idea is to create a common language and process so agencies can determine the level of protection required based on how sensitive or critical the information is. By defining impact levels (low, moderate, high) in the categorization, FIPS 200 then specifies the minimum security controls that must be in place for each level, ensuring a consistent baseline across the government. So focusing on standards for categorizing information and information systems captures the function of FIPS 200—providing a standardized way to assess what needs protection, which then informs the appropriate security controls. The other areas—encryption key lengths, incident handling, auditing—are components within the overall control framework, but they reflect specific controls rather than the overarching standardization and baseline-setting role of the document.