-: In this lesson, we'll continue 2 2
on to step two in the risk management framework, 3 3
which is called "Categorizing Your System". 4 4
There are three tasks in this step. 5 5
By the end of task C1, 6 6
you'll have a complete system description 7 7
with all the essential characteristics described. 8 8
There are many examples of the different types 9 9
of descriptive information that you could include 10 10
in your security and privacy plans. 11 11
Let me give you some examples. 12 12
There's the name of the system, 13 13
it's version number or release number, 14 14
the manufacturer, the owner of the system, 15 15
the custodian of the system, 16 16
the organization that manages, owns, 17 17
or controls the system, there's the location 18 18
of the system and so on. 19 19
The system description will later be attached 20 20
to your security and privacy plans. 21 21
Now, the outputs of task C2, 22 22
which is called "Security Categorization" 23 23
are the impact levels for each type 24 24
of information in your system. 25 25
Security categorization considers 26 26
how the organization will be impacted 27 27
if there's a loss of confidentiality, integrity, 28 28
or availability of the information. 29 29
Note that some organizations 30 30
use categories like classified and restricted 31 31
when they're categorizing their information. 32 32
You'll end the categorized step with task C3, 33 33
where your security categorization is reviewed 34 34
and hopefully approved 35 35
by your key decision makers. 36 36
As you complete step two, 37 37
make sure that all key stakeholders are aware 38 38
of what classifications have been selected 39 39
for your data types 40 40
because you'll use this information 41 41
as a key input into step number three, 42 42
which is called "Select".