FIPS 199 is Standard for Security Categorization of which?

• A. Federal Information Systems
• B. State governments
• C. Commercial networks
• D. Personal health records

Answer: (A)

FIPS 199 establishes how to categorize security requirements for information and information systems used by federal government agencies. It defines three impact levels—low, moderate, and high—based on the potential effects on confidentiality, integrity, and availability. This standard is specifically about Federal Information Systems, meaning systems operated by or for U.S. federal agencies to handle government data. It does not cover state governments, general commercial networks, or personal health records outside the federal context. Therefore, the standard applies to Federal Information Systems.