After security categorization, which publication specifies the minimum security requirements?

After security categorization, which publication specifies the minimum security requirements?

• A. SP 800-37
• B. FIPS 200
• C. SP 800-53
• D. SP 800-122

Answer: (B)

The correct answer is B, FIPS 200. This publication is essential in the context of federal information systems because it establishes the minimum security requirements that are derived from the security categorizations specified in the Federal Information Processing Standards (FIPS). Specifically, FIPS 200 outlines the security requirements for federal information and information systems to protect the confidentiality, integrity, and availability of the information based on its impact level of low, moderate, or high. In the process of security categorization, organizations assess the information systems and classify them according to their potential impact on the organization if compromised. FIPS 200 then provides the necessary baseline security controls that must be implemented to appropriately mitigate risks, ensuring that organizations meet federal standards for protecting sensitive information. The other options pertain to different aspects of information security. SP 800-37 focuses on the Risk Management Framework and provides guidance on managing information security risks. SP 800-53 provides a catalog of security controls for federal information systems to help organizations select appropriate controls based on their risk assessment and categorization. SP 800-122 addresses the protection of personally identifiable information (PII) but does not specify the overarching minimum security requirements like FIPS 200 does.

The correct answer is B, FIPS 200. This publication is essential in the context of federal information systems because it establishes the minimum security requirements that are derived from the security categorizations specified in the Federal Information Processing Standards (FIPS). Specifically, FIPS 200 outlines the security requirements for federal information and information systems to protect the confidentiality, integrity, and availability of the information based on its impact level of low, moderate, or high.

In the process of security categorization, organizations assess the information systems and classify them according to their potential impact on the organization if compromised. FIPS 200 then provides the necessary baseline security controls that must be implemented to appropriately mitigate risks, ensuring that organizations meet federal standards for protecting sensitive information.

The other options pertain to different aspects of information security. SP 800-37 focuses on the Risk Management Framework and provides guidance on managing information security risks. SP 800-53 provides a catalog of security controls for federal information systems to help organizations select appropriate controls based on their risk assessment and categorization. SP 800-122 addresses the protection of personally identifiable information (PII) but does not specify the overarching minimum security requirements like FIPS 200 does.