The text of the Risk Assessment and FIPS 199 Categorization
Approval #
| Role | Name | Signature |
|---|---|---|
| Chief Information Security Officer (CISO) |
Revision History #
| Date | Version | Description | Reviewer |
|---|---|---|---|
| 2026-10-31 | 1.0 | Initial issuance | [Reviewer name] |
Review cycle: At the frequency the Risk Assessment Policy (POL-RA) sets, and after a significant change.
Mandate. National Institute of Standards and Technology (NIST) SP 800-53 RA-2 requires security categorization of each system per Federal Information Processing Standards (FIPS) 199; RA-3 requires a risk assessment documented and reviewed on an organization-defined frequency and upon significant change. The System Owner completes this template for each system. The result informs baseline selection (PL-10/PL-11, including the High Value Asset (HVA) overlay where the system is designated) and the authorization decision.
Part A — FIPS 199 Security Categorization (RA-2) #
For each information type processed, stored, or transmitted (use NIST SP 800-60 as the reference catalog):
| Information type | Confidentiality | Integrity | Availability | Rationale |
|---|---|---|---|---|
| [Type] | [L/M/H] | [L/M/H] | [L/M/H] | [Impact rationale] |
System categorization (high-water mark): SC = {C: , I: , A: _} → Overall: [L/M/H]
The System Owner approves the categorization, and the CISO concurs. The System Owner evaluates HVA designation against the Office of Management and Budget (OMB) M-19-03 categories. Where the system is designated, the Cybersecurity and Infrastructure Security Agency (CISA) HVA overlay applies.
Part B — Risk Assessment (RA-3, NIST SP 800-30) #
B.1 Scope and Approach #
System boundary assessed, assessment date, participants, and information sources (scan results, threat intelligence, prior assessments, incident history).
B.2 Threat and Vulnerability Identification #
| # | Threat source/event | Vulnerability / predisposing condition | Existing controls |
|---|---|---|---|
| 1 | [e.g., external actor exploiting internet-facing service] | [e.g., unremediated finding] | [relevant controls] |
B.3 Risk Determination #
| # | Likelihood | Impact | Risk (L×I) | Rationale |
|---|---|---|---|---|
| 1 | [VL-VH] | [VL-VH] | [VL-VH] | [per 800-30 App. G/H/I scales] |
B.4 Risk Response #
Rate each risk with the risk matrix in the Risk Management Strategy (PLAN-RMS-001). For each risk at or above the tolerance in its Risk Appetite and Tolerance Statement, record the response: mitigate, accept, transfer, or avoid. For a mitigation, record the corrective action and the plan of action and milestones (POA&M) reference. For an acceptance, record the decision of the official the Risk Management Strategy names for that risk level.
B.5 Review #
The System Owner reviews this assessment as often as POL-RA requires, after any significant change to the system or its threat environment, and before reauthorization. Results update the System Security and Privacy Plan (SSPP) and the system’s entries in the cybersecurity risk register, which follow the Cybersecurity Risk Register Template (TMPL-RISKREG-001).
References #
These are the sources this document cites, with a link to each official text.
- NIST SP 800-60 Rev. 1: Guide for Mapping Types of Information and Information Systems to Security Categories, August 2008.
- OMB M-19-03: Strengthening the Cybersecurity of Federal Agencies by Enhancing the High Value Asset Program, December 26, 2018.