Security categorization of an National Security System must consider the security categories of all information types resident on it. Response:

The security categorization of an information system, including a National Security System (NSS), is fundamentally based on the "high-water mark" principle. This principle requires that the system's overall security category be determined by the highest potential impact level (Low, Moderate, or High) across the security objectives of confidentiality, integrity, and availability for all information types that are processed, stored, or transmitted by the system. To establish this high-water mark accurately, every type of information resident on the system must be identified and its individual security category determined. This is the first and a mandatory step in the Risk Management Framework (RMF).

The "False" option is incorrect. If the security categorization process did not consider all information types, it would be possible to miss the information type with the highest potential impact. This would lead to an incorrect and likely lower security categorization for the entire system, resulting in the implementation of an insufficient baseline of security controls and exposing the NSS to a greater level of risk than is acceptable.

1. Federal Information Processing Standards (FIPS) Publication 199, Standards for Security Categorization of Federal Information and Information Systems.

Section 3.2, Security Category of an Information System: "The security category of an information system is the high water mark of the security categories of all the information types resident on the information system."

2. NIST Special Publication (SP) 800-37, Revision 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.

Section 2.3, RMF Step 1: Categorize: "The security categorization process is the first step in the RMF... The process is carried out by the information owner/steward and the system owner... by determining the security category for the information system, including the information processed, stored, and transmitted by the system based on an impact analysis." This explicitly states the process includes the information on the system.

3. Committee on National Security Systems Instruction (CNSSI) No. 1253, Security Categorization and Control Selection for National Security Systems.

Attachment 3, Section 1, Security Categorization: "The security category of an NSS is determined by the combination of the security impact values for each of the security objectives (Confidentiality, Integrity, and Availability) that are based on the security category of the information processed, stored, or transmitted by the NSS." This instruction, specific to NSS, directly links the system's category to the category of the information it handles, reinforcing the need to assess all of it.