NIST releases draft security standard

Draft FIPS 199: Standards for Security Categorization of Federal Information and Information Systems

The National Institute of Standards and Technology's Computer Security Division today released the draft of a new Federal Information Processing Standard, FIPS 199, which dictates how agencies should categorize their systems based on the security risk faced by each.

The standard is the first step in several requirements generated by NIST under the Federal Information Security Management Act (FISMA) of 2002, all aimed at setting minimum security requirements for all government systems not related to national security.

The draft outlines three categories of risk, which are based on the potential impact of a breach in three areas: the confidentiality, integrity and availability of the information in the system.

NIST chose to focus on impact because every federal system faces some level of threat, and that threat changes every day, said Ed Roback, chief of the NIST Computer Security Division. Therefore, the most prudent path to follow is to base categorization on the potential harm to the agency and to the people whose information is stored in the system, he said.

Comments on the draft are due within 90 days, and can be submitted to [email protected]

The next steps for NIST will be to issue guidance on how different types of information — such as medical, judicial and geospatial — align with the three categories, and to then set guidance for the minimum security steps to be taken based on the categories, Roback said.


  • Acquisition
    network monitoring (nmedia/

    How companies should prep for CMMC

    Defense contractors should be getting ready for the Defense Department's impending cybersecurity standard expected to be released this month.

  • Workforce
    Volcanic Tablelands Calif BLM Bishop Field Office employee. April 28, 2010

    BLM begins move out of Washington

    The decision to relocate staff could disrupt key relationships with Congress and OMB and set the stage for a dismantling of the agency, say former employees.

Stay Connected


Sign up for our newsletter.

I agree to this site's Privacy Policy.