CGRC · Question #508
A system in which at least one security objective is assigned a FIPS Publication 199 potential impact value of high best defines... Response:
The correct answer is A. A high-Impact System. A high-impact system is defined as an information system where at least one security objective (confidentiality, integrity, or availability) is assigned a FIPS Publication 199 potential impact value of high.
Question
A system in which at least one security objective is assigned a FIPS Publication 199 potential impact value of high best defines... Response:
Options
- AA high-Impact System
- BA major application
- CAn external system (or component)
- DA major application
How the community answered
(47 responses)- A89% (42)
- B2% (1)
- C2% (1)
- D6% (3)
Why each option
A high-impact system is defined as an information system where at least one security objective (confidentiality, integrity, or availability) is assigned a FIPS Publication 199 potential impact value of high.
According to FIPS Publication 199, an information system is classified as a 'high-impact system' if the potential impact for a breach of confidentiality, integrity, or availability for any of its information types is determined to be HIGH. This designation drives the rigor of security controls required.
'A major application' is an older term sometimes used in government contexts, but it is not the precise and technical definition based on FIPS 199 impact levels.
'An external system (or component)' describes a system's relationship to an organization or its physical boundary, not its security impact level.
This choice is a duplicate of B, and similarly incorrect, as it is not the formal FIPS 199 definition of a high-impact system.
Concept tested: FIPS 199 High-Impact System Definition
Source: https://csrc.nist.gov/publications/detail/fips/199/final
Topics
Community Discussion
No community discussion yet for this question.