Security Categorization Worksheet

Security Categorization Worksheet template: A worksheet for categorizing a system and its information by the impact of a loss of confidentiality, integrity or availability, with the rationale and approval SP 800-53 RA-2 requires.

Type	Program stage	Status	Template version	NIST basis
Form or register	Foundation	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

A worksheet for categorizing a system and its information by the impact of a loss of confidentiality, integrity or availability, with the rationale and approval SP 800-53 RA-2 requires.

Controls satisfied

Control	Title
RA-2	Security Categorization

Downloads

Variant	Ready to adopt	Annotated
All baselines	Word · Markdown	Word · Markdown

The register as a spreadsheet: CSV, with one column per field.

Preview (annotated)

Guidance

Categorization drives almost everything that follows: the control baseline (PL-10), the depth of assessment, and how the authorizing official weighs risk. Work through it with the information owners, not just the security team, because they know what harm a loss would cause. The result goes into section 6 of the System Security Plan; keep this worksheet as the supporting rationale.

System name	System identifier	Prepared by	Date
Fill in: system name	Fill in: unique system identifier	Fill in: name and title	Fill in: date

1. Impact levels

Rate each loss using these levels, adapted from FIPS 199. The adverse effect is on the organization’s operations, its assets, or individuals.

Level	A loss of confidentiality, integrity or availability could be expected to have	For example, the loss might
Low	A limited adverse effect	Noticeably reduce the effectiveness of primary functions that can still be performed; cause minor damage to assets or minor financial loss; or cause minor harm to individuals
Moderate	A serious adverse effect	Significantly reduce the effectiveness of primary functions that can still be performed; cause significant damage to assets or significant financial loss; or cause significant harm to individuals, not involving loss of life or serious life-threatening injury
High	A severe or catastrophic adverse effect	Leave the organization unable to perform one or more primary functions; cause major damage to assets or major financial loss; or cause severe or catastrophic harm to individuals, involving loss of life or serious life-threatening injury

Describe what each level means for Organization name in its own terms, for example money lost, people affected or hours of outage: Fill in: organization-specific examples for low, moderate and high, or a reference to the risk management strategy.

2. System description

Item	Description
Purpose	Fill in: the mission or business function the system supports
Users	Fill in: who uses the system, internal and external
Boundary	Fill in: the main components, and where the system ends
Connections	Fill in: other systems it exchanges information with
Personally identifiable information	Fill in: yes or no; if yes, what kinds

3. Information types

List every type of information the system processes, stores or transmits in the register at the end of this worksheet (RA-2a). For each, rate the impact of a loss of each security objective, and say why. Where a type’s provisional rating is changed, for example because of the volume of records, a legal requirement or how critical the function is, record the change and the reason.

Guidance

Confidentiality of information meant for the public can be rated “not applicable”; integrity and availability always get a rating. Consider aggregation: many records together can do more harm than one.

4. System categorization

The system’s rating for each objective is the highest rating of any of its information types (the high-water mark), raised where the system itself calls for it, for example because other systems depend on it or its own configuration and security information needs more protection. A system is never rated “not applicable” for any objective.

Objective	System impact level	Rationale
Confidentiality	Fill in: low, moderate or high	Fill in: rationale
Integrity	Fill in: low, moderate or high	Fill in: rationale
Availability	Fill in: low, moderate or high	Fill in: rationale

The overall security categorization is Fill in: low, moderate or high, the highest of the three, and the system uses the Fill in: Low, Moderate or High control baseline (PL-10). The results and rationale are recorded in section 6 of the system security plan (RA-2b).

Federal systems

Federal systems categorize under FIPS 199 (February 2004), whose impact definitions and examples section 1 adapts and whose high-water mark rule section 4 follows, and identify information types and their provisional impact levels from NIST SP 800-60 Rev. 1 (August 2008; Volume 2 lists the types). Under FIPS 200, the system’s impact level is the highest value for any of the three objectives, and it selects the matching SP 800-53B baseline.

• Record the SP 800-60 identifier of each information type in the register.
• Record each provisional impact level from SP 800-60 Volume 2, and any change from it, with the reason.

5. Review and approval

The authorizing official, or a designated representative, reviews and approves the categorization (RA-2c).

Name	Title	Decision	Signature	Date
Fill in: name	System owner	Submitted		Fill in: date
Fill in: name	Fill in: authorizing official or designated representative	Fill in: approved, or returned with comments		Fill in: date

Review this worksheet whenever the system, the information it handles or its environment of operation changes significantly.

Register

One row per information type. “Provisional levels” are the starting ratings from a catalog such as SP 800-60 Volume 2, where one is used; leave blank otherwise.

Information type	Catalog identifier	Provisional levels (C, I, A)	Confidentiality	Integrity	Availability	Rationale and adjustments
Fill in: information type	Fill in: identifier, if any	Fill in: provisional levels, if any	Fill in: low, moderate, high or not applicable	Fill in: low, moderate or high	Fill in: low, moderate or high	Fill in: why, and any adjustment