NIST800-RA-2 RA-2 Security Categorization
NIST800-RA-2 in NIST SP 800-53 Rev 5 (NIST SP 800-53 Rev 5, Release 5.2.0). All NIST SP 800-53 Rev 5 controls held. Open NIST SP 800-53 Rev 5 on the standards site.
The control as we hold it
RA-2 Security Categorization. a. Categorize the system and information it processes, stores, and transmits; b. Document the security categorization results, including supporting rationale, in the security plan for the system; and c. Verify that the authorizing official or authorizing official designated representative reviews and approves the security categorization decision.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
SOC 2
- SOC2-C1.1 C1.1 Identifying and maintaining confidential information (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: RA - Risk Assessment), in our words, not a statement of the standard and not binding on an assessor.
- the risk-assessment policy
- the risk-assessment reports
- the risk-treatment records