What is the focus of FIPS 200?

• A. Minimum security requirements for federal information and information systems
• B. Security policy
• C. Risk management
• D. Incident response

Answer: (A)

FIPS 200 focuses on establishing minimum security requirements for federal information and information systems. It specifies a baseline set of protective controls that agencies must implement to achieve a basic level of security for federal data, and it works with the NIST SP 800-53 control catalog to define what those protections look like in practice. The baselines are organized by impact level (low, moderate, high) defined in FIPS 199, ensuring consistent protection across systems handling federal information. Security policy is broader and sets organizational rules, risk management is the overarching process that uses these controls to manage risk, and incident response is a specific area within security controls—none of these are the central focus of FIPS 200.