# Security Categorization Worksheet
**Template version:** 1.0.0 · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0
*Tailor this template before adoption; it is not legal advice.* Latest version: . Dedicated to the public domain under CC0 1.0 (): adopt and change it without attribution.
> **Guidance:** Categorization drives almost everything that follows: the control baseline (PL-10), the depth of assessment, and how the authorizing official weighs risk. Work through it with the information owners, not just the security team, because they know what harm a loss would cause. The result goes into section 6 of the [System Security Plan](https://kston83.github.io/nist-guide/templates/plans/system-security-plan/); keep this worksheet as the supporting rationale.
| System name | System identifier | Prepared by | Date |
| --- | --- | --- | --- |
| [Fill in: system name] | [Fill in: unique system identifier] | [Fill in: name and title] | [Fill in: date] |
## 1. Impact levels
Rate each loss using these levels, adapted from FIPS 199. The adverse effect is on the organization's operations, its assets, or individuals.
| Level | A loss of confidentiality, integrity or availability could be expected to have | For example, the loss might |
| --- | --- | --- |
| Low | A limited adverse effect | Noticeably reduce the effectiveness of primary functions that can still be performed; cause minor damage to assets or minor financial loss; or cause minor harm to individuals |
| Moderate | A serious adverse effect | Significantly reduce the effectiveness of primary functions that can still be performed; cause significant damage to assets or significant financial loss; or cause significant harm to individuals, not involving loss of life or serious life-threatening injury |
| High | A severe or catastrophic adverse effect | Leave the organization unable to perform one or more primary functions; cause major damage to assets or major financial loss; or cause severe or catastrophic harm to individuals, involving loss of life or serious life-threatening injury |
Describe what each level means for [Organization name] in its own terms, for example money lost, people affected or hours of outage: [Fill in: organization-specific examples for low, moderate and high, or a reference to the risk management strategy].
## 2. System description
| Item | Description |
| --- | --- |
| Purpose | [Fill in: the mission or business function the system supports] |
| Users | [Fill in: who uses the system, internal and external] |
| Boundary | [Fill in: the main components, and where the system ends] |
| Connections | [Fill in: other systems it exchanges information with] |
| Personally identifiable information | [Fill in: yes or no; if yes, what kinds] |
## 3. Information types
List every type of information the system processes, stores or transmits in the register at the end of this worksheet (RA-2a). For each, rate the impact of a loss of each security objective, and say why. Where a type's provisional rating is changed, for example because of the volume of records, a legal requirement or how critical the function is, record the change and the reason.
> **Guidance:** Confidentiality of information meant for the public can be rated "not applicable"; integrity and availability always get a rating. Consider aggregation: many records together can do more harm than one.
## 4. System categorization
The system's rating for each objective is the highest rating of any of its information types (the high-water mark), raised where the system itself calls for it, for example because other systems depend on it or its own configuration and security information needs more protection. A system is never rated "not applicable" for any objective.
| Objective | System impact level | Rationale |
| --- | --- | --- |
| Confidentiality | [Fill in: low, moderate or high] | [Fill in: rationale] |
| Integrity | [Fill in: low, moderate or high] | [Fill in: rationale] |
| Availability | [Fill in: low, moderate or high] | [Fill in: rationale] |
The overall security categorization is [Fill in: low, moderate or high], the highest of the three, and the system uses the [Fill in: Low, Moderate or High] control baseline (PL-10). The results and rationale are recorded in section 6 of the system security plan (RA-2b).
### Federal systems
Federal systems categorize under [FIPS 199](https://csrc.nist.gov/pubs/fips/199/final) (February 2004), whose impact definitions and examples section 1 adapts and whose high-water mark rule section 4 follows, and identify information types and their provisional impact levels from [NIST SP 800-60 Rev. 1](https://csrc.nist.gov/pubs/sp/800/60/v1/r1/final) (August 2008; [Volume 2](https://csrc.nist.gov/pubs/sp/800/60/v2/r1/final) lists the types). Under [FIPS 200](https://csrc.nist.gov/pubs/fips/200/final), the system's impact level is the highest value for any of the three objectives, and it selects the matching SP 800-53B baseline.
- Record the SP 800-60 identifier of each information type in the register.
- Record each provisional impact level from SP 800-60 Volume 2, and any change from it, with the reason.
## 5. Review and approval
The authorizing official, or a designated representative, reviews and approves the categorization (RA-2c).
| Name | Title | Decision | Signature | Date |
| --- | --- | --- | --- | --- |
| [Fill in: name] | [System owner] | Submitted | | [Fill in: date] |
| [Fill in: name] | [Fill in: authorizing official or designated representative] | [Fill in: approved, or returned with comments] | | [Fill in: date] |
Review this worksheet whenever the system, the information it handles or its environment of operation changes significantly.
## Register
One row per information type. "Provisional levels" are the starting ratings from a catalog such as SP 800-60 Volume 2, where one is used; leave blank otherwise.
| Information type | Catalog identifier | Provisional levels (C, I, A) | Confidentiality | Integrity | Availability | Rationale and adjustments |
| --- | --- | --- | --- | --- | --- | --- |
| [Fill in: information type] | [Fill in: identifier, if any] | [Fill in: provisional levels, if any] | [Fill in: low, moderate, high or not applicable] | [Fill in: low, moderate or high] | [Fill in: low, moderate or high] | [Fill in: why, and any adjustment] |