Every later control decision depends on how important the system is. RA-2 Security Categorization is where you decide. NIST 800-53 binds US federal systems, and others by contract. For everyone else it is a reference, and the same exercise sits behind data classification and tiering in most security programs.
What it means in practice
The statement has three parts. Categorize the system and the information it processes, stores and transmits. Document the result, with the reasoning, in the system security plan. And verify that the authorizing official, or a designated representative, reviews and approves the decision.
The guidance explains that categories describe the potential adverse impact on operations, assets and individuals if the system is compromised through loss of confidentiality, integrity or availability. It also suggests privacy risk assessments can help you understand the effect on individuals. The record lists one enhancement, RA-2.1 Impact level Prioritization, which helps rank components within a system.
In a private company, the authorizing official is whoever owns the risk, often a CTO or CISO. Pick a scale you can explain, such as low, moderate and high, and write down what each means for your business.
Evidence to collect
- The categorization scheme and its definitions.
- A completed categorization per system, with rationale for each of confidentiality, integrity and availability.
- Approval records from the risk owner.
- The security plan or system record that stores the result.
Common gaps
- Everything is rated high, so the rating guides nothing.
- The rating was set at launch and never revisited after the system took on customer data.
- No approval trail.
How to implement it
List systems and the data they hold. Ask three questions for each: what happens if this data leaks, if it is altered, if it is unavailable for a day? Rate each, take the highest as the system rating, and get sign off.
Quick check
Why rate availability separately?
A system can hold public data and still be critical to operations. Each of the three properties can have a different impact, and the control treats them separately.
