FIPS 199 is the federal standard for categorizing information and information systems by the potential impact if they are compromised. You judge three security objectives, confidentiality, integrity and availability, and the result feeds control selection. Get this step wrong and every later step inherits the error.
What the standard covers
NIST published FIPS 199 in February 2004. It frames categorization around an agency's level of concern for confidentiality, integrity and availability, and the potential impact on agency assets and operations if those are lost. The commonly used levels are low, moderate and high. The NIST page itself speaks only of potential impact in general terms, so read the full standard for the exact definitions.
The steps
- List the information types the system processes, stores or transmits.
- For each type, judge the impact of losing confidentiality, integrity and availability separately.
- Take the highest value for each objective across all the types.
- Record the result with your reasoning.
The Risk Management Framework puts this in its Categorize step. NIST describes it as assigning impact levels to the system and the information it handles based on an impact analysis. The Select step then chooses controls from the matching SP 800-53 baseline.
Common mistakes
Treating the three objectives as one number. A public data feed may have low confidentiality impact but high integrity impact, because bad data causes harm. A scheduling system may matter mostly for availability.
Categorizing the software instead of the data and mission. The impact depends on what the system holds and supports, not how clever the code is.
Letting the project team pick the level alone. The system owner and security staff should agree, and for a federal system the authorizing side has the final say.
Not revisiting it. If you add a new data type, rerun the exercise.
How this shows up for vendors
If you sell into federal customers, the customer will usually tell you the level. For cloud services, you may then meet a program baseline matched to it, such as the FedRAMP classes. Ask for the categorization in writing before you scope work, because it changes cost and timeline.
Safeguard's asset discovery and SBOM and dependency scanning can help you list what a system contains, which is the input to step one. The judgment itself stays with people.
Quick check
Which three objectives does FIPS 199 look at?
Confidentiality, integrity and availability.
Can one system have different levels for different objectives?
Yes. You assess each objective separately and record each result. Read the standard for how the overall level is derived.
Sources
Last reviewed: 19 October 2026.
