In 2003, NIST developed a new Certification & Accreditation (C&A) guideline known as FIPS 199. What levels of potential impact are defined by FIPS 199? Each correct answer represents a complete…

The correct answer is A. Low C. High D. Medium. FIPS 199 (Standards for Security Categorization of Federal Information and Information Systems), published by NIST in 2004, defines three levels of potential impact on organizations or individuals if a security breach were to occur: Low, Moderate, and High. In the context of…

Security and Privacy Governance, Risk Management, and Compliance Program

Question

In 2003, NIST developed a new Certification & Accreditation (C&A) guideline known as FIPS 199. What levels of potential impact are defined by FIPS 199? Each correct answer represents a complete solution. Choose all that apply.

Options

ALow
BModerate
CHigh
DMedium

How the community answered

(34 responses)

A
91% (31)
B
9% (3)

Explanation

FIPS 199 (Standards for Security Categorization of Federal Information and Information Systems), published by NIST in 2004, defines three levels of potential impact on organizations or individuals if a security breach were to occur: Low, Moderate, and High. In the context of this question, the answer choices list 'Medium' (D) rather than 'Moderate' (B) as a correct option. Note that the official FIPS 199 terminology uses 'Moderate,' not 'Medium' - these terms are often used interchangeably in exam contexts, but the authoritative NIST document uses Low, Moderate, and High. The 'Moderate' option (B) in the choices is considered a distractor here, with 'Medium' (D) being treated as the equivalent correct term in this question's answer key.

Topics

#FIPS 199#Impact Levels#Information Classification#Risk Categorization

Community Discussion

No community discussion yet for this question.

Full CAP Practice