Can a value of not applicable be assigned to any security objective in the context of establishing a security category for an information system. Response:

According to FIPS 199, all three security objectives-Confidentiality, Integrity, and Availability-must be considered and assigned an impact level (Low, Moderate, or High) when establishing a security category for an information system. It is not permissible to assign "not applicable" to any of these objectives, as they represent fundamental aspects of information security that must always be evaluated.

Assigning "Yes" would imply that one or more of the core security objectives (Confidentiality, Integrity, Availability) could be deemed irrelevant for an information system, which contradicts established federal information security categorization standards like FIPS 199.