Wikia

The IT Law Wiki

FIPS 200

31,926pages on
this wiki
Talk0

Citation Edit

National Institute of Standards and Technology, Minimum Security Requirements for Federal Information and Information Systems (FIPS 200) (Mar. 9, 2006) (full-text).

Overview Edit

FIPS 200 is a mandatory federal standard developed by NIST in response to FISMA. To comply with the federal standard, organizations must first determine the security category of their information system in accordance with FIPS 199, "Standards for Security Categorization of Federal Information and Information Systems," and then apply the appropriately tailored set of baseline security controls in NIST Special Publication 800-53.

These baseline control recommendations are:

FIPS 200 and NIST Special Publication 800-53 Edit

Organizations have flexibility in applying the baseline security controls in accordance with the guidance provided in NIST Special Publication 800-53. This allows organizations to select security controls that more closely align with their mission and business requirements and environments of operation.

In applying the provisions of FIPS 200, agencies first categorize their information and systems as required by FIPS 199, and then typically select an appropriate set of security controls from NIST Special Publication 800-53 to satisfy their minimum security requirements. This helps to ensure that appropriate security requirements and security controls are applied to all federal information and information systems including cloud computing.

FIPS 200 and NIST Special Publication 800-53, in combination, help ensure that appropriate security requirements and security controls are applied to all federal information and information systems. An organizational assessment of risk validates the initial security control selection and determines if any additional controls are needed to protect organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the United States. The resulting set of agreed-upon security controls establishes a level of security due diligence for the organization.

Around Wikia's network

Random Wiki