Written and maintained by CASRAI Editorial Board
Last updated
FIPS 199 is the federal standard that tells an organization how to rate the security impact of its information and information systems. It sorts each system into a security category using three objectives (confidentiality, integrity, availability) and three impact levels (low, moderate, high). Those ratings then drive which security controls are selected. For a university or research lab, FIPS 199 usually shows up through a federal contract or agency requirement rather than by direct force of the standard.
What FIPS 199 is and who runs it
FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, is published by the National Institute of Standards and Technology (NIST). As described on the official NIST page on 2026-10-29, it is listed as Final, with the history entry “02/01/04: FIPS 199 (Final)” and no withdrawal notice. It is tied to the E-Government Act, FISMA, HSPD-7 and OMB Circular A-130.
The standard exists because the Federal Information Security Management Act (FISMA, Title III of the E-Government Act of 2002, Pub. L. 107-347) gave NIST three tasks: standards to categorize information and systems, guidelines on the types of information in each category, and minimum security requirements. FIPS 199 answers the first task. Its stated value is a common framework for expressing security, which supports oversight and consistent reporting to OMB and Congress.
Who FIPS 199 applies to
As written in the standard (February 2004), it applies to two groups:
- all federal information other than classified information; and
- all federal information systems other than national security systems.
Federal agency officials “shall use” it whenever a federal requirement calls for a categorization. State, local and tribal governments, and private-sector critical-infrastructure organizations, “may consider the use of these standards as appropriate.” In practice that means a non-federal organization, such as a university handling federal data, normally meets FIPS 199 because a contract, grant term or agency policy asks for a categorization. Whether a specific award imposes it is a question for the award terms and your compliance office. See who is responsible for CUI compliance at a university for how those duties are usually divided.
What FIPS 199 requires: three objectives, three impact levels
The three security objectives come from FISMA (44 U.S.C. 3542). Each is defined by what is lost when it fails:
- Confidentiality: preserving authorized restrictions on information access and disclosure, including protecting personal privacy and proprietary information. Loss means unauthorized disclosure.
- Integrity: guarding against improper modification or destruction, including ensuring non-repudiation and authenticity. Loss means unauthorized modification or destruction.
- Availability: ensuring timely and reliable access to and use of information. Loss means disruption of access or use.
Each objective gets an impact level for a potential loss:
| Level | Standard’s wording | What it means in the standard |
|---|---|---|
| Low | Limited adverse effect | Noticeably reduced effectiveness, minor asset damage, minor financial loss, or minor harm to individuals |
| Moderate | Serious adverse effect | Significantly reduced effectiveness, significant damage or financial loss, or significant harm to individuals that does not involve loss of life or serious life-threatening injury |
| High | Severe or catastrophic adverse effect | Inability to perform one or more primary functions, major damage or loss, or severe or catastrophic harm including loss of life or serious life-threatening injury |
The standard applies these definitions within the context of each organization and the overall national interest. Harm to individuals can include loss of privacy entitled under law.
The security category (SC) format
A security category is written as a set of three pairs. For an information type: SC = {(confidentiality, impact), (integrity, impact), (availability, impact)}. Allowed values are low, moderate, high, or not applicable, and “not applicable” is allowed only for confidentiality. The standard’s own first example is public web information: {(confidentiality, NA), (integrity, MODERATE), (availability, MODERATE)}.
How the categorization steps work
- List the information types. An information type is a category such as privacy, medical, proprietary, financial, investigative, contractor sensitive or security management, defined by the organization or by a law, executive order or policy.
- Rate each type on all three objectives. Ask what a loss of confidentiality, then integrity, then availability would do, and choose low, moderate or high. Do not skip an objective because it seems less relevant.
- Apply the high water mark to the system. For each objective, the system takes the highest value among the information types it holds. “Not applicable” cannot be assigned to a system. System information such as routing tables, password files and key-management data is protected at the level of the most critical user information the system handles.
- Record the category. Write the system’s SC in the same {confidentiality, integrity, availability} format so it can be reported and reused.
- Feed it into control selection. The standard says categories are used together with vulnerability and threat information when assessing risk. FIPS 199 itself does not list controls or baselines.
Worked example: the high water mark
The standard’s Example 4 describes an acquisition system holding two information types. Contract information is rated {MODERATE, MODERATE, LOW} and administrative information is rated {LOW, LOW, LOW}. Taking the highest value for each objective gives the system {MODERATE, MODERATE, LOW}. Confidentiality and integrity are moderate because one type is moderate; availability stays low because both types are low. Note that the result is a maximum per objective, not an average and not a single overall label.
Typical phases of a categorization effort
The standard does not set a calendar, so timing depends on the organization. The phases usually run in this order:
- Inventory systems and the information each one holds.
- Assign information types and rate each type on the three objectives.
- Compute the system-level category by high water mark.
- Review the result with the system owner and record it.
- Pass the category to control selection, then revisit it when the system’s information changes.
Common mistakes
- Averaging instead of taking the maximum. The standard requires the highest value per objective.
- Rating confidentiality only. FIPS 199 rates all three objectives, and many systems are mainly an integrity or availability concern.
- Treating FIPS 199 as a control list. It categorizes; it does not select or describe controls.
- Skipping the information-type step. Rating the system directly hides which data drives the result.
- Assigning “not applicable” to a system. That value is allowed only for an information type’s confidentiality.
- NIST CSRC, FIPS 199 publication page and full text (PDF, February 2004), checked 2026-10-29. DOI: 10.6028/NIST.FIPS.199.
- NIST CSRC, SP 800-60 Vol. 1 Rev. 1, checked 2026-10-29.
- NIST CSRC, FIPS 200, checked 2026-10-29.
Related standards and how they connect
FIPS 199 is the first step in a chain of NIST publications. Dates and titles below are as described on the official NIST pages on 2026-10-29.
| Publication | Role in the chain | As described by NIST |
|---|---|---|
| FIPS 199 (February 2004) | Categorize information and systems by impact | Final |
| SP 800-60 Vol. 1 Rev. 1 (August 2008) | Map types of information and systems to security categories | Final; supersedes the 2004 Vol. 1; companion Vol. 2 Rev. 1 |
| FIPS 200 (March 2006) | Minimum security requirements for federal information and systems, met through a risk-based selection of controls | Final; the second of the two standards FISMA required |
| SP 800-53 and SP 800-53B | Control catalog and control baselines | See NIST SP 800-53 Rev. 5 for the baselines |
For programs that protect research data under federal contracts, the nearby topics are controlled unclassified information (CUI) and NIST SP 800-171 in university research. For the wider field, see what cybersecurity is.
FAQ
What is FIPS 199?
FIPS 199 is the NIST standard, finalized in February 2004, for categorizing federal information and information systems by the potential impact of losing confidentiality, integrity or availability. The result is a security category such as {MODERATE, MODERATE, LOW}.
What are the FIPS 199 impact levels?
Low (limited adverse effect), moderate (serious adverse effect) and high (severe or catastrophic adverse effect). Each is assigned separately for confidentiality, integrity and availability.
What is the high water mark?
The high water mark is the rule for rating a system: for each of the three objectives, take the highest value among all the information types on the system. A system holding one moderate and one low confidentiality type is moderate for confidentiality.
