What standard defines how information systems are categorized and the impact levels (Low, Moderate, High)?

• A. NIST SP 800-53
• B. ISO/IEC 27001
• C. NIST SP 800-37
• D. FIPS 199

Answer: (D)

Defining how information systems are categorized by impact level is the role of FIPS 199. It sets the security categorization framework using three impact levels—Low, Moderate, and High—for each information type, evaluated against potential damage to confidentiality, integrity, or availability. This categorization then guides the selection of appropriate security controls and informs the risk-management process (RMF) that follows, often aligning with control baselines in NIST SP 800-53. Other standards play different roles: NIST SP 800-53 lists the controls themselves, NIST SP 800-37 outlines the RMF steps, and ISO/IEC 27001 focuses on an information security management system. So, the standard that defines how systems are categorized by impact levels is FIPS 199.