Federal Information Processing Standard 199 (FIPS 199) is a US federal standard, published by the National Institute of Standards and Technology (NIST) in February 2004, for categorizing information and information systems by how much harm a security failure could cause. Each system is rated Low, Moderate or High impact for confidentiality, integrity and availability. That rating drives how much protection the system needs, which is why buyers hear impact levels from government customers and cloud providers. This entry is general information, not legal advice.
At a glance
- FIPS 199 rates information and systems Low, Moderate or High impact.
- Ratings consider confidentiality, integrity and availability separately; the system’s overall level is the highest of them.
- The rating is the Categorize step of the NIST Risk Management Framework.
- Its companion, FIPS 200, sets minimum security requirements and uses the rating to pick a NIST SP 800-53 baseline.
- Agencies categorize their own systems; FedRAMP classes are a separate label for cloud services.
What problem it solves
Not every system deserves the same protection. A public web page and a system holding sensitive case files face very different consequences if something goes wrong, and spending the same on both wastes money in one place and leaves gaps in another.
FIPS 199 gives a consistent way to decide how serious a breach of a given system would be, before anyone picks controls or tools. For buyers, it explains the “Low, Moderate, High” language in government contracts and cloud listings, and why a higher rating brings a longer list of requirements, more evidence and usually higher cost.
How it works
Identify information types. The organization lists the kinds of information a system stores, processes or transmits.
Rate each security objective. For each information type, it decides the potential impact of losing confidentiality (unauthorized disclosure), integrity (unauthorized change or destruction) and availability (disruption of access).
Apply the high water mark. The system’s overall category is the highest impact level among those ratings. A system that is Low for confidentiality but Moderate for availability is a Moderate system.
Use the result. Under the NIST Risk Management Framework (NIST RMF), categorization is the second step. FIPS 200, published in March 2006, sets minimum security requirements across seventeen security-related areas and directs organizations to meet them using the NIST SP 800-53 baseline that matches the system’s level.
Impact levels
| Impact level | Potential effect of a loss of confidentiality, integrity or availability | How it is set | What follows |
|---|---|---|---|
| Low | Limited adverse effect on operations, assets or individuals | The system owner or agency categorizes the system, usually reviewed in the authorization process | Low control baseline in SP 800-53B |
| Moderate | Serious adverse effect | As above | Moderate control baseline |
| High | Severe or catastrophic adverse effect | As above | High control baseline, with the most extensive requirements |
The rating is a judgment by the organization that owns the system, not a certification a vendor earns. A provider can say what level its service was assessed against, but your agency or customer decides the level of the system that uses it. Confirm with your contracting officer or authorizing official.
When it matters for buyers
- When a government customer asks for your impact level. The answer shapes which controls and evidence you will need.
- When choosing a cloud provider for government work. Make sure the provider’s assessed level or class fits the system it will support.
- When estimating compliance cost. Moving from Moderate to High adds controls, documentation and assessment effort.
- When rating your own systems. Borrowing the low, moderate and high approach can help prioritize security spending.
Our governance, risk and compliance overview covers advisors who help categorize systems and prepare for assessments.
Questions to ask vendors
- Which impact level or FedRAMP class was your service assessed against, and for which service offering?
- Does that level match the categorization of the system we plan to use it for?
- Which security controls do you meet for us, and which remain our responsibility?
- How would you support us if our system were categorized at a higher level later?
- Where is our data stored and who can access it?
How it differs from FedRAMP certification classes
FIPS 199 impact levels are assigned by agencies to their own systems. FedRAMP certification classes describe how much assurance a cloud service has demonstrated, and they have replaced FedRAMP’s old Low, Moderate and High baseline names. Class B covers the former LI-SaaS and Low baselines, Class C covers Moderate and Class D covers High, while Class A is a new entry class. FedRAMP cautions that classes are not one-for-one substitutes for an agency’s impact level, and the program is in transition, so check current rules. Agencies apply both within the security program required by FISMA.
Problems this helps with
- A government customer asks for our system's impact level
- Not sure whether our system is Low, Moderate or High and what that changes
- Confused about how impact levels relate to FedRAMP classes
