NIST SP 800-60 Explained: Information Types

NIST SP 800-60 is the NIST guide that tells a federal agency how to map the types of information a system handles to security categories. If you searched “nist 800 60” or “nist 800-60”, this page walks through what the two volumes contain, the four categorization steps and where the current Rev. 1 and the Rev. 2 working draft stand. Details were checked against the NIST publication pages on 2026-10-29.

What NIST SP 800-60 is and who runs it

The full title is “Guide for Mapping Types of Information and Information Systems to Security Categories” (SP 800-60 Vol. 1 Rev. 1). It is published by the National Institute of Standards and Technology (NIST). The authors listed on the NIST publication page are Kevin Stine, Richard Kissel and William Barker of NIST, with Jim Fahlsing and Jessica Gulick of SAIC. Rev. 1 was published in August 2008, has the status Final, and supersedes the June 2004 version.

It exists because of the Federal Information Security Management Act (FISMA, Title III of the E-Government Act of 2002). According to NIST’s abstract, FISMA tasked NIST with two things: standards for categorizing information and information systems, and guidelines recommending the types of information and systems to include in each category. SP 800-60 was issued in response to the second task; the first became FIPS 199. The guide builds on FIPS 199 and on the Federal Enterprise Architecture (FEA) reference model work of the OMB FEA Program Management Office (the October 2007 FEA Consolidated Reference Model Document, Version 2.3).

Scope: which systems it applies to

The guide states that it applies to all federal information systems other than national security systems. It assumes the reader already knows FIPS 199, so read that standard first. For the standard itself, see the CASRAI guide to FIPS 199 security categorization; this page does not repeat it.

Volume I vs Volume II

NIST describes the document as two volumes: a basic guideline and a volume of appendices.

Part	What it contains
Volume I (Rev. 1)	Section 2 on the value of categorization and its role in the system development life cycle, certification and accreditation, and the Risk Management Framework (RMF); Section 3 on FIPS 199 objectives and impact levels; Section 4 on the categorization process; Appendix A (glossary) and Appendix B (references).
Volume II (Rev. 1), Appendices A and B	Glossary and references.
Volume II, Appendix C	Provisional impact levels and the rationale for management and support information (administrative, management and service information).
Volume II, Appendix D	Provisional impact levels and rationale for mission-based information (mission information and service delivery mechanisms).
Volume II, Appendix E	Legislative and executive sources that specify the sensitivity or criticality of information.

The provisional assignments live in Volume II, Appendices C and D. Volume I explains how to use them. Volume II Rev. 1 was also published in August 2008 and supersedes the 2004 Volume II.

What it provides

SP 800-60 does not set the impact levels as law; it recommends provisional ones. NIST defines provisional levels as the initial or conditional impact determinations made until all considerations are fully reviewed, analyzed and accepted in the later categorization steps by appropriate officials. The system’s final security category then drives the selection of baseline security controls, which is why categorization is called the key first step in the RMF.

The four categorization steps

Section 4 of Volume I sets out four steps:

1. Identify information types (Section 4.1). Information types fall into mission-based information and management and support information. Section 4.1.4 covers types that are not listed in the guide.
2. Select provisional impact levels (Section 4.2). Take the provisional confidentiality, integrity and availability levels for each identified type from Volume II.
3. Review provisional levels, then adjust and finalize the impact level of each information type (Section 4.3).
4. Assign the system security category (Section 4.4). The system category uses the high water mark: for each of the three security objectives (confidentiality, integrity, availability), the highest impact level among the system’s information types.

How the steps fit together (process phases)

The guide gives a sequence, not a calendar. In order: identify what information the system handles, look up provisional levels, have the provisional levels reviewed and finalized by the appropriate officials, then assign the system-level category that feeds control selection. Any timing depends on the agency’s own authorization process; the NIST publication gives no durations.

Common mistakes

• Treating provisional levels as final. The guide describes them as initial or conditional until Step 3 is complete.
• Looking in the wrong appendix. Management and support information is in Volume II Appendix C; mission-based information is in Appendix D.
• Applying it to national security systems. The stated scope excludes them.
• Skipping information types that are not listed. Section 4.1.4 exists for types the guide does not list.
• Reading the Rev. 2 working draft as the current guide. As of 2026-10-29, NIST lists Rev. 1 (2008) as the final version.

Rev. 1 and the Rev. 2 draft

NIST published an initial working draft of Rev. 2 on January 31, 2024; comments were due by March 18, 2024. According to NIST, the draft proposes to:

• update the methodology to better address privacy considerations during security categorization;
• fold relevant SP 800-122 guidance into the document and withdraw SP 800-122;
• align with SP 800-37 Rev. 2;
• update the information types taxonomy and provisional levels, including the NARA CUI registry;
• publish the methodology as a document and the information types as a spreadsheet, and later through the Cybersecurity and Privacy Reference Tool.

NIST says it plans an initial public draft after feedback. This is a working draft, so cite Rev. 1 for the current published guidance and check the NIST page for any later status change.

Related publications

Publication	Relationship to SP 800-60
FIPS 199	The categorization standard that SP 800-60 builds on; the guide assumes you know it.
NIST SP 800-53 Rev. 5	The security category from SP 800-60 drives selection of baseline security controls.
SP 800-37 (Risk Management Framework)	Categorization is the key first step in the RMF; the Rev. 2 draft proposes alignment with SP 800-37 Rev. 2.
SP 800-122	Its relevant guidance is proposed in the Rev. 2 working draft to be folded in, with SP 800-122 withdrawn.

For the surrounding authorization process, see the CASRAI guides to authority to operate and NIST SP 800-30 risk assessment.

FAQ

What is NIST 800-60?

It is NIST Special Publication 800-60, a two-volume guide for mapping types of information and information systems to the security categories defined in FIPS 199. Volume I explains the process; Volume II holds the provisional impact levels by information type.

What is the difference between NIST 800 60 Volume 1 and Volume 2?

Volume I is the basic guideline with the four-step process. Volume II is the set of appendices, including provisional levels for management and support information (Appendix C) and mission-based information (Appendix D).

Is SP 800-60 Rev. 2 final?

No. As of 2026-10-29, NIST lists Rev. 2 as an initial working draft published January 31, 2024, and Rev. 1 (August 2008) as the final version.

Does SP 800-60 apply to national security systems?

No. The guide applies to federal information systems other than national security systems.

Sources

• NIST CSRC, SP 800-60 Vol. 1 Rev. 1. Date checked: 2026-10-29.
• NIST CSRC, SP 800-60 Vol. 2 Rev. 1. Date checked: 2026-10-29.
• NIST, SP 800-60 Vol. 1 Rev. 1 (PDF). Date checked: 2026-10-29.
• NIST CSRC, SP 800-60 Rev. 2 initial working draft. Date checked: 2026-10-29.