# NIST Guides Federal Information Categorization

NIST SP 800-60 explains how agencies categorize information on non-national-security federal systems to inform security-control selection. Contractors supporting these systems should identify applicable information types, review provisional impact levels, confirm final levels with appropriate officials, and apply the system’s high-water mark. The article describes existing guidance rather than a new funding opportunity or contract award; contractors should use final Revision 1 guidance while tracking proposed Revision 2 updates.

- Contractors can use the categorization process when supporting agencies’ security-control decisions for federal information systems.
- Confirming impact levels with the appropriate agency officials and applying the system’s high-water mark helps align system categorization with control selection.
- Use final Revision 1 guidance for current work; the proposed Revision 2 is an update to track, not a final requirement identified in this signal.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 29, 2026

### Government Entities
- National Institute of Standards and Technology (NIST)
- Office of Management and Budget Federal Enterprise Architecture Program Management Office (OMB FEA PMO)
- National Archives and Records Administration (NARA)

### Sources
- [NIST SP 800-60 Explained: Information Types — CASRAI](https://casrai.org/guides/nist-800-60) - CASRAI