Written and maintained by CASRAI Editorial Board
Last updated
FIPS 200, Minimum Security Requirements for Federal Information and Information Systems, is the NIST standard that sets the baseline for information security across US federal agencies. It does one thing: it names seventeen security-related areas that every federal information system must cover, and it requires agencies to meet them by applying the matching control baseline from NIST Special Publication 800-53. It is mandatory for covered federal systems and, according to the standard itself, cannot be waived.
Facts below are taken from the standard and its NIST publication page, as described on the official pages and checked on 2026-10-29.
What FIPS 200 is and who runs it
NIST published FIPS 200 in March 2006 as a final standard, and it supersedes SP 800-26 (2001). NIST’s publication page records no later standard that replaces it and lists FIPS 199 as the related publication. A planning note dated 17 March 2023 on that page directs inquiries to NIST.
The standard exists because of the Federal Information Security Management Act (FISMA), part of the E-Government Act of 2002 (Public Law 107-347). FISMA required NIST to develop two security standards, and FIPS 200 is the second of them. The first, FIPS 199, defines how systems are categorised by impact; see our guide to FIPS 199 security categorization. The stated goal of FIPS 200 is to set minimum levels of due diligence for information security.
Who must comply (applicability)
The standard applies to all information within the federal government other than classified information, and to all federal information systems other than national security systems as defined in 44 U.S.C. 3542(b)(2). It does not bind state, local or tribal governments or private organisations. The text says that state, local and tribal governments, and the private-sector organisations that make up US critical infrastructure, are “encouraged to consider the use of this standard, as appropriate.”
Classified information and national security systems are outside the standard, which says it was developed to complement similar standards for national security systems.
What FIPS 200 requires: the seventeen areas
FIPS 200 requires a broad-based, balanced information security program that addresses the management, operational and technical aspects of protecting information and systems. The standard lists seventeen security-related areas, and minimum security requirements are defined for each:
- Access control
- Awareness and training
- Audit and accountability
- Certification, accreditation, and security assessments
- Configuration management
- Contingency planning
- Identification and authentication
- Incident response
- Maintenance
- Media protection
- Physical and environmental protection
- Planning
- Personnel security
- Risk assessment
- Systems and services acquisition
- System and communications protection
- System and information integrity
This is the wording of the 2006 PDF. NIST’s current publication page uses present-day naming for some areas; for example, the area the 2006 text calls “certification, accreditation, and security assessments” appears there as “Assessment, Authorization and Monitoring”. Same area, newer name. The standard is implemented through the controls of SP 800-53; see NIST SP 800-53 Rev. 5 for the current catalogue.
How the requirements are met: categorise, select, tailor
FIPS 200 does not list individual controls. It delegates them to SP 800-53 through a fixed sequence:
- Categorise the system. Use FIPS 199 to assign an impact level. Under the standard’s definitions, a system is low-impact if all three security objectives (confidentiality, integrity, availability) are low; moderate if at least one is moderate and none is higher; high if at least one is high.
- Select the matching baseline. The agency selects one of the three appropriately tailored control baselines (low, moderate, high) from SP 800-53 that corresponds to the impact level.
- Apply the whole baseline. Agencies must employ all security controls in the respective baseline unless the tailoring guidance in SP 800-53 allows a specific exception, and must also meet the baseline’s minimum assurance requirements.
- Use the current version. A footnote in the standard states that organisations must use the most current version of SP 800-53, as amended. The 2006 standard therefore tracks the control catalogue as it is revised, rather than freezing the 2006 control set.
Tailoring is not an individual decision. The standard says it must be coordinated with, and approved by, the appropriate organisational officials, such as the chief information officer, the senior agency information security officer and authorising officials. It also states that NIST reviews the SP 800-53 controls at least annually, and that the baselines are expected to change over time.
Typical sequence of phases
The standard sets no calendar for an individual system, only a deadline for the standard’s own adoption: it was effective immediately on publication, and agencies had to comply not later than one year from the effective date. For a system, the phases follow the dependency order above:
- Categorisation under FIPS 199, which must come first because it determines the baseline.
- Baseline selection and documented tailoring, with sign-off from the officials named above.
- Implementation of the full set of selected controls across the seventeen areas.
- Review against the current version of SP 800-53 as it changes.
Common mistakes
- Assuming a waiver is possible. The standard states that FISMA makes no provision for waivers to FIPS made mandatory by the Secretary of Commerce.
- Treating the seventeen areas as a checklist. The areas are the scope. The requirement is met through the SP 800-53 baseline selected for the system’s impact level.
- Using an outdated control catalogue. The standard requires the most current version of SP 800-53, as amended.
- Tailoring without approval. Removing or adjusting controls needs the coordination and approval described above, and only within the allowances in the SP 800-53 tailoring guidance.
- Applying it to out-of-scope systems. National security systems and classified information fall outside this standard.
Related standards
| Publication | Role relative to FIPS 200 |
|---|---|
| FIPS 199 | The first of the two FISMA-required standards; assigns the low, moderate or high impact level that FIPS 200 uses to choose a baseline. |
| NIST SP 800-53 Rev. 5 | The control catalogue and baselines through which FIPS 200’s minimum requirements are met. |
For broader background on the field, see our overviews of cybersecurity and of the NIST 800-171 CUI requirements for university research.
FAQ
What is FIPS 200?
It is the NIST standard, published March 2006, that sets minimum security requirements for federal information and information systems across seventeen areas, met by applying the SP 800-53 control baseline matching a system’s FIPS 199 impact level.
What are the 17 areas?
Access control; awareness and training; audit and accountability; certification, accreditation, and security assessments; configuration management; contingency planning; identification and authentication; incident response; maintenance; media protection; physical and environmental protection; planning; personnel security; risk assessment; systems and services acquisition; system and communications protection; and system and information integrity.
Is FIPS 200 mandatory, and can it be waived?
It is mandatory for federal information and non-national-security federal information systems. The standard states that FISMA provides no waivers for FIPS made mandatory by the Secretary of Commerce.
How do FIPS 199, FIPS 200 and SP 800-53 fit together?
FIPS 199 categorises a system as low, moderate or high impact. FIPS 200 requires the matching SP 800-53 baseline, tailored and approved, to meet the seventeen areas. SP 800-53 supplies the controls themselves.
Sources
- NIST CSRC, FIPS 200: Minimum Security Requirements for Federal Information and Information Systems, publication page, checked 2026-10-29.
- NIST, FIPS PUB 200 (PDF, March 2006), DOI 10.6028/NIST.FIPS.200, checked 2026-10-29.
