FIPS and Federal Information Processing Standards

FIPS Standards: Understanding Federal Information Processing Standards for CGRC Exam Success

Introduction to FIPS Standards

Federal Information Processing Standards (FIPS) are a critical component of the U.S. federal government's approach to information security and technology standardization. For anyone pursuing the CGRC (Certified in Governance, Risk and Compliance) certification, a thorough understanding of FIPS standards is essential, as they form the backbone of federal information security requirements and directly influence the scope of systems subject to authorization.

What Are FIPS Standards?

FIPS are standards and guidelines developed by the National Institute of Standards and Technology (NIST) for federal computer systems. They are issued by NIST after approval by the Secretary of Commerce pursuant to the Federal Information Security Modernization Act (FISMA) and the Information Technology Management Reform Act (Clinger-Cohen Act).

FIPS publications cover a wide range of topics, including:
- Encryption standards
- Security categorization of information systems
- Minimum security requirements
- Digital signature standards
- Authentication standards
- Hash standards

These standards are mandatory for federal agencies and their contractors when handling federal information. Unlike NIST Special Publications (which are generally guidance), FIPS carry the force of federal regulation and compliance is not optional.

Why Are FIPS Standards Important?

1. Legal Mandate: FIPS are legally binding for federal agencies. Under FISMA, all federal agencies must comply with FIPS standards. Non-compliance can result in findings during audits and potential consequences for agency leadership.

2. Baseline Security: FIPS establish minimum security requirements that create a consistent security posture across the federal government. This uniformity is critical for interoperability and trust between agencies.

3. Scope Definition: FIPS standards directly influence the scope of information system authorization. FIPS 199 and FIPS 200 together define how systems are categorized and what minimum controls must be applied, which directly shapes the authorization boundary and scope of assessment.

4. Risk Management Foundation: FIPS provide the foundational framework upon which the Risk Management Framework (RMF) is built. Without understanding FIPS, practitioners cannot properly implement the RMF.

5. Industry Benchmark: Many private sector organizations also adopt FIPS standards, especially FIPS 140-series for cryptographic modules, making them relevant beyond government contexts.

Key FIPS Standards You Must Know for the CGRC Exam

FIPS 199 – Standards for Security Categorization of Federal Information and Information Systems

This is arguably the most important FIPS for the CGRC exam. FIPS 199 establishes the framework for categorizing information and information systems based on the potential impact of a security breach across three security objectives:

- Confidentiality: Preserving authorized restrictions on information access and disclosure
- Integrity: Guarding against improper information modification or destruction
- Availability: Ensuring timely and reliable access to and use of information

Each security objective is assigned one of three impact levels:
- Low: Limited adverse effect on organizational operations, assets, or individuals
- Moderate: Serious adverse effect on organizational operations, assets, or individuals
- High: Severe or catastrophic adverse effect on organizational operations, assets, or individuals

The overall system categorization is determined by the high-water mark principle — the system's security category is the highest impact level among all three security objectives. For example, if a system is rated Low for confidentiality, Moderate for integrity, and High for availability, the overall system categorization is High.

The format for expressing security categorization is:
SC information system = {(confidentiality, impact), (integrity, impact), (availability, impact)}

For example: SC_system = {(confidentiality, moderate), (integrity, moderate), (availability, low)}

The overall categorization of this system would be Moderate.

FIPS 200 – Minimum Security Requirements for Federal Information and Information Systems

FIPS 200 specifies minimum security requirements across 17 security-related areas for federal information and information systems. It works in conjunction with FIPS 199 and NIST SP 800-53. Once a system is categorized per FIPS 199, FIPS 200 mandates the minimum security controls that must be applied.

The 17 security-related areas addressed by FIPS 200 include:
1. Access Control (AC)
2. Awareness and Training (AT)
3. Audit and Accountability (AU)
4. Certification, Accreditation, and Security Assessments (CA) — now Security Assessment and Authorization
5. Configuration Management (CM)
6. Contingency Planning (CP)
7. Identification and Authentication (IA)
8. Incident Response (IR)
9. Maintenance (MA)
10. Media Protection (MP)
11. Physical and Environmental Protection (PE)
12. Planning (PL)
13. Personnel Security (PS)
14. Risk Assessment (RA)
15. System and Services Acquisition (SA)
16. System and Communications Protection (SC)
17. System and Information Integrity (SI)

FIPS 200 directs agencies to use NIST SP 800-53 to select the appropriate set of security controls based on the FIPS 199 categorization. The baseline controls (Low, Moderate, or High) correspond to the system's categorization level.

FIPS 140-2 / FIPS 140-3 – Security Requirements for Cryptographic Modules

FIPS 140 is the standard for validating cryptographic modules used within federal systems. It defines four increasing levels of security:

- Level 1: Basic security requirements; no specific physical security mechanisms required beyond production-grade components
- Level 2: Adds requirements for tamper-evident coatings or seals and role-based authentication
- Level 3: Adds requirements for tamper-resistant physical mechanisms and identity-based authentication
- Level 4: Provides the highest level of security with complete envelope of protection around the cryptographic module and detection/response to unauthorized physical access

FIPS 140-3 has superseded FIPS 140-2 and aligns with ISO/IEC 19790 and ISO/IEC 24759. However, many existing validations still reference FIPS 140-2, and the exam may reference both versions.

Federal agencies are required to use FIPS-validated cryptographic modules. This is a common exam topic — if a question asks about encryption in a federal context, FIPS 140 validation is typically the correct answer.

FIPS 201 – Personal Identity Verification (PIV) of Federal Employees and Contractors

FIPS 201 establishes the standard for personal identity verification credentials for federal employees and contractors. This standard was mandated by Homeland Security Presidential Directive 12 (HSPD-12) and defines the PIV Card, which is the standard form of identification for accessing federal facilities and information systems.

Key concepts include:
- PIV credentials are used for both physical and logical access
- Multi-factor authentication using the PIV card
- Biometric data stored on the card
- Certificate-based authentication

How FIPS Standards Work Within the Scope of the System

Understanding how FIPS standards define and influence the scope of a system is critical for the CGRC exam:

1. Step 1 – Categorize the System (FIPS 199): The first step in the Risk Management Framework involves categorizing the information system using FIPS 199. This determines the system's impact level and directly shapes the scope of the authorization effort. Higher impact levels require more rigorous controls and assessment activities.

2. Step 2 – Select Controls (FIPS 200 + NIST SP 800-53): Based on the FIPS 199 categorization, FIPS 200 dictates the minimum security requirements, and NIST SP 800-53 provides the specific control baselines. The scope of the system determines which controls apply.

3. Authorization Boundary: FIPS 199 categorization applies to the information system within its defined authorization boundary. The boundary defines the scope — all components within the boundary must meet the security requirements corresponding to the system's categorization level.

4. Inherited Controls: When determining scope, some controls may be inherited from common control providers (e.g., shared infrastructure). FIPS requirements still apply, but the responsibility for implementing them may be shared.

5. Continuous Monitoring: FIPS requirements don't end at authorization. The system must continuously meet FIPS standards throughout its lifecycle, and any changes that affect the system's categorization or compliance require re-evaluation.

How FIPS Relates to Other Standards and Frameworks

FIPS standards do not exist in isolation. They work within a broader ecosystem:

- FISMA mandates that agencies comply with FIPS standards
- NIST SP 800-53 provides the detailed control catalog referenced by FIPS 200
- NIST SP 800-60 provides guidance for mapping information types to FIPS 199 categories
- NIST SP 800-37 (Risk Management Framework) describes the process within which FIPS 199 categorization occurs
- CNSSI 1253 extends FIPS 199 for national security systems
- FedRAMP leverages FIPS 199 and FIPS 200 for cloud service provider authorizations

Common Misconceptions About FIPS

- FIPS are optional guidelines: No. FIPS are mandatory for federal agencies. NIST Special Publications are generally guidance (unless mandated by regulation), but FIPS carry the force of law under FISMA.

- FIPS apply only to government agencies: While FIPS are mandatory for federal agencies, they also apply to contractors, cloud service providers serving the government, and any organization handling federal information. Additionally, many private sector organizations voluntarily adopt FIPS standards.

- The highest single impact value determines the overall system categorization: Correct — this IS how it works. The high-water mark principle means the highest impact level across confidentiality, integrity, and availability determines the overall categorization.

- FIPS 199 categorization is a one-time activity: No. System categorization should be reviewed periodically and whenever significant changes occur to the system or its operating environment.

Exam Tips: Answering Questions on FIPS and Federal Information Processing Standards

1. Know the High-Water Mark: This is one of the most frequently tested concepts. Always remember that the overall system security categorization equals the highest impact level among the three security objectives (confidentiality, integrity, availability). If you see a question presenting individual impact values, select the highest one as the system's overall categorization.

2. Distinguish Between FIPS and NIST SP: Exam questions may try to trick you by mixing up FIPS standards with NIST Special Publications. Remember: FIPS are mandatory federal standards, while NIST SPs are generally guidance (though they become mandatory when referenced by FIPS or federal regulation). If a question asks about mandatory requirements, lean toward FIPS.

3. Remember the Sequence: FIPS 199 (categorize) comes before FIPS 200 (minimum security requirements). This maps to the RMF steps: Categorize → Select → Implement → Assess → Authorize → Monitor. If a question asks what happens first, categorization (FIPS 199) is always the starting point.

4. FIPS 199 Impact Definitions: Be prepared to identify which impact level (Low, Moderate, High) corresponds to specific descriptions. Key phrases to look for:
- "Limited adverse effect" = Low
- "Serious adverse effect" = Moderate
- "Severe or catastrophic adverse effect" = High

5. FIPS 140 for Cryptography: Whenever a question involves encryption, cryptographic modules, or data protection in a federal context, think FIPS 140. If the question asks about validated encryption, the answer almost certainly involves FIPS 140-2 or FIPS 140-3.

6. FIPS 201 for Identity: Questions about federal employee identity credentials, PIV cards, or HSPD-12 compliance should point you toward FIPS 201.

7. Context Clues in Questions: Pay attention to whether the question specifies a federal agency, a contractor, or a private organization. FIPS are mandatory for federal agencies and their contractors. For purely private organizations, FIPS may be voluntary unless contractually required.

8. Process of Elimination: When facing questions about FIPS, eliminate answers that suggest FIPS are optional, that they only apply to classified systems, or that they were developed by organizations other than NIST.

9. Understand the Three Security Objectives: Confidentiality, Integrity, and Availability (CIA) are central to FIPS 199. Know their definitions precisely. Exam questions may describe a scenario and ask you to identify which security objective is most affected.

10. Watch for Tricky Wording: Questions may ask about the information type categorization versus the information system categorization. FIPS 199 applies to both, but the system categorization aggregates all information types within the authorization boundary using the high-water mark approach.

11. Know NIST SP 800-60: While not a FIPS standard itself, NIST SP 800-60 is the guide for mapping information types to FIPS 199 categories. Questions about how to determine the appropriate categorization for specific types of information may reference this document.

12. Practice Scenario-Based Questions: Many CGRC exam questions are scenario-based. Practice reading scenarios that describe a federal system, its data types, and its users, then determine the correct FIPS 199 categorization and the appropriate next steps under FIPS 200.

13. Remember That FIPS Cannot Be Waived Easily: Federal agencies cannot simply decide to ignore FIPS requirements. Any deviation requires formal approval processes. If an exam question suggests ignoring or bypassing FIPS, that answer is almost certainly wrong.

14. Link FIPS to the Authorizing Official: The Authorizing Official (AO) relies on FIPS 199 categorization to understand the risk associated with a system. The categorization level determines the rigor of the assessment and the level of risk the AO must accept. This connection between FIPS and the authorization decision is exam-relevant.

15. National Security Systems Exception: Be aware that FIPS standards apply to federal information systems but not to national security systems (those processing classified information). National security systems fall under CNSSI 1253 and the Committee on National Security Systems (CNSS). This distinction may appear in exam questions designed to test your understanding of FIPS applicability.

Summary

FIPS standards are the mandatory cornerstone of federal information security. For the CGRC exam, your understanding of FIPS 199 (security categorization), FIPS 200 (minimum security requirements), FIPS 140-2/140-3 (cryptographic module validation), and FIPS 201 (personal identity verification) will be tested extensively. Focus on how these standards define the scope of systems, drive control selection, and support the overall Risk Management Framework. Master the high-water mark principle, understand the distinction between mandatory FIPS and guidance-oriented NIST SPs, and practice applying these concepts in scenario-based questions to maximize your exam performance.