Establishing an overall sensitivity level for an Information System based on the aggregated sensitivity level of all data by CIA; is referred to as the ______________. Response:

The 'high-water mark' approach for information system categorization dictates that the overall security category (low, moderate, or high) for a system is determined by the highest individual impact level (confidentiality, integrity, or availability) of the information processed, stored, or transmitted by that system. This ensures that the system's security controls are sufficient to protect its most sensitive data.

A 'low-water mark' approach would assign the lowest impact level, which would be insufficient for protecting sensitive data.

A 'medium-water mark' approach would imply an average or middle level, which also wouldn't guarantee protection for the most sensitive data.

There is a correct term described by the definition.