ra-2-security-categorization

name	RA-2_security-categorization
description	Categorize the system and information it processes, stores, and transmits;
category	information-gathering
version	5.2.0
author	cyberstrike-official
tags	["nist","sp800-53","rev5","ra-2","ra"]
tech_stack	["any"]
cwe_ids	[]
chains_with	["CM-8","MP-4","PL-2","PL-10","PL-11","PM-7","RA-3","RA-5","RA-7","RA-8"]
prerequisites	[]
severity_boost	{"CM-8":"Chain with CM-8 for comprehensive security coverage","MP-4":"Chain with MP-4 for comprehensive security coverage","PL-2":"Chain with PL-2 for comprehensive security coverage"}

RA-2 Security Categorization

High-Level Description

Family: Risk Assessment (RA) Framework: NIST SP 800-53 Rev 5

Security categories describe the potential adverse impacts or negative consequences to organizational operations, organizational assets, and individuals if organizational information and systems are compromised through a loss of confidentiality, integrity, or availability. Security categorization is also a type of asset loss characterization in systems security engineering processes that is carried out throughout the system development life cycle. Organizations can use privacy risk assessments or privacy impact assessments to better understand the potential adverse effects on individuals. CNSSI 1253 provides additional guidance on categorization for national security systems.

Organizations conduct the security categorization process as an organization-wide activity with the direct involvement of chief information officers, senior agency information security officers, senior agency officials for privacy, system owners, mission and business owners, and information owners or stewards. Organizations consider the potential adverse impacts to other organizations and, in accordance with USA PATRIOT and Homeland Security Presidential Directives, potential national-level adverse impacts.

Security categorization processes facilitate the development of inventories of information assets and, along with CM-8 , mappings to specific system components where information is processed, stored, or transmitted. The security categorization process is revisited throughout the system development life cycle to ensure that the security categories remain accurate and relevant.

What to Check

• Verify RA-2 Security Categorization is documented in SSP
• Validate all 3 control requirements are implemented
• Confirm control is operating effectively
• Review evidence of continuous monitoring for RA-2

How to Test

Step 1: Review Documentation

Examine the System Security Plan (SSP) and related artifacts for RA-2 implementation details. Verify the organization has documented how this control is satisfied.

Step 2: Validate Implementation

# For cloud environments, use cloud-audit-mcp tools
# For on-premises, review system configurations directly

# Example: Check if account management policies exist
grep -r "account.management\|access.control" /etc/security/ 2>/dev/null