Which standard discusses mapping types to categories in security categorization?

• A. SP 800-60
• B. SP 800-122
• C. FIPS 199
• D. CNSSI-1253

Answer: (A)

Mapping information types to security categories is about linking different kinds of data to the defined protection levels for a system. The standard that provides the actual method for doing this mapping is SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories. It explains how to take information types (like medical records, financial data, or system logs) and assign the appropriate impact level for confidentiality, integrity, and availability, which then determines the overall security category used in risk assessment and control selection. FIPS 199 defines what those categories are (low, moderate, high) and the impact criteria, but it does not describe the mapping process itself. SP 800-122 focuses on protecting PII confidentiality, not general information-type mapping, and CNSSI-1253 covers security controls alignment but not the specific mapping method.