ComplianceNIST 800-53 control

NIST-RA-2 Security Categorization

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
RA Risk Assessment
Control
RA-2

Control statement

a. Categorize the system and information it processes, stores, and transmits; b. Document the security categorization results, including supporting rationale, in the security plan for the system; and c. Verify that the authorizing official or authorizing official designated representative reviews and approves the security categorization decision.

Discussion

Security categories describe the potential adverse impacts or negative consequences to organizational operations, organizational assets, and individuals if organizational information and systems are compromised through a loss of confidentiality, integrity, or availability. Security categorization is also a type of asset loss characterization in systems security engineering processes that is carried out throughout the system development life cycle. Organizations can use privacy risk assessments or privacy impact assessments to better understand the potential adverse effects on individuals. [CNSSI 1253](#4e4fbc93-333d-45e6-a875-de36b878b6b9) provides additional guidance on categorization for national security systems. Organizations conduct the security categorization process as an organization-wide activity with the direct involvement of chief information officers, senior agency information security officers, senior agency officials for privacy, system owners, mission and business owners, and information owners or stewards. Organizations consider the potential adverse impacts to other organizations and, in accordance with [USA PATRIOT](#13f0c39d-eaf7-417a-baef-69a041878bb5) and Homeland Security Presidential Directives, potential national-level adverse impacts. Security categorization processes facilitate the development of inventories of information assets and, along with [CM-8](#cm-8) , mappings to specific system components where information is processed, stored, or transmitted. The security categorization process is revisited throughout the system development life cycle to ensure that the security categories remain accurate and relevant.

Related

Related control · Compliance (14)

  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-MP-4 Media Storage NIST 800-53 control
  • NIST-PL-10 Baseline Selection NIST 800-53 control
  • NIST-PL-11 Baseline Tailoring NIST 800-53 control
  • NIST-PL-2 System Security and Privacy Plans NIST 800-53 control
  • NIST-PM-7 Enterprise Architecture NIST 800-53 control
  • NIST-RA-3 Risk Assessment NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-RA-7 Risk Response NIST 800-53 control
  • NIST-RA-8 Privacy Impact Assessments NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SC-38 Operations Security NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-12 Information Management and Retention NIST 800-53 control

Referenced by Compliance · enhancement of (1)

  • NIST-RA-2(1) Impact-level Prioritization NIST 800-53 enhancement

Referenced by Compliance · has member (1)

  • NIST-RA Risk Assessment NIST 800-53 family

Referenced by Compliance · related control (16)

  • NIST-CM-12 Information Location NIST 800-53 control
  • NIST-IA-5(6) Protection of Authenticators NIST 800-53 enhancement
  • NIST-PL-10 Baseline Selection NIST 800-53 control
  • NIST-PL-11 Baseline Tailoring NIST 800-53 control
  • NIST-PM-11 Mission and Business Process Definition NIST 800-53 control
  • NIST-PM-7 Enterprise Architecture NIST 800-53 control
  • NIST-RA-3 Risk Assessment NIST 800-53 control
  • NIST-RA-3(1) Supply Chain Risk Assessment NIST 800-53 enhancement
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-RA-7 Risk Response NIST 800-53 control
  • NIST-RA-8 Privacy Impact Assessments NIST 800-53 control
  • NIST-RA-9 Criticality Analysis NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SC-38 Operations Security NIST 800-53 control
  • NIST-SI-12 Information Management and Retention NIST 800-53 control
  • NIST-SI-19 De-identification NIST 800-53 control