What it means
The categorization process identifies information types, evaluates impact, documents assumptions, and establishes a basis for control selection and authorization decisions.
Why it matters
A defensible impact level helps organizations apply protection proportionate to mission and business consequences rather than system size or visibility alone.
Practical focus
- Identify all processed, stored, and transmitted information types
- Evaluate impact on operations, assets, people, and obligations
- Consider interconnections and shared dependencies
- Approve and revisit categorization after material change
Common mistakes
- Categorizing only the technology
- Ignoring aggregated data impact
- Using the lowest convenient impact level
- Failing to document rationale and dependencies
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: