FIPS 199 is essential for federal agencies to categorize their information systems based on the potential impact of a security breach. XQ’s encryption and data security solutions align with FIPS 199 by enabling organizations to protect data confidentiality, integrity, and availability across all impact levels.
XQ’s Role in Supporting FIPS 199 Objectives:
- Confidentiality:
- XQ’s Contribution: XQ ensures that sensitive data is comprehensively encrypted using FIPS 140-2 compliant algorithms, safeguarding it from unauthorized access. This comprehensive approach protects the confidentiality of information at rest, in transit, and during remote access, meeting the confidentiality requirement across low, moderate, and high impact levels.
- Integrity:
- XQ’s Contribution: XQ guarantees the integrity of information by embedding encryption policies directly into the data. This ensures that any attempts to tamper with or alter the data are detectable, providing reassurance that the information retains its integrity throughout its lifecycle, regardless of its FIPS 199 categorization.
- Availability:
- XQ’s Contribution: XQ’s encryption ensures that data remains accessible to authorized users by securing it against unauthorized modifications and breaches. By managing cryptographic keys with defined expiration periods and policy-based management, XQ ensures data availability while maintaining the highest security standards.
- XQ’s keystore is deployed as a SaaS offering or as an on-prem deployment that can be made available even within disconnected environments. These options ensure that XQ can be deployed to meet the customer’s availability requirements.
Application to FIPS 199 Impact Levels:
XQ secures the data within these information systems, ensuring that the data’s confidentiality, integrity, and availability are maintained in line with FIPS 199 requirements. While XQ does not manage the system infrastructure itself, it ensures that the data within those systems is encrypted, securely transmitted, and accessible only to authorized users.
- Low Impact:
- XQ’s Support: For systems categorized as low impact, XQ protects the confidentiality and integrity of non-sensitive information by ensuring secure encryption at the file level. This minimizes the risk of minor breaches or operational disruptions.
- Moderate Impact:
- XQ’s Support: In moderate impact scenarios, XQ enforces stricter access controls and encryption policies, ensuring that significant but non-catastrophic breaches are mitigated. XQ’s policy-based encryption provides enhanced security without sacrificing usability, empowering your team to work securely.
- High Impact:
- XQ’s Support: For high-impact systems, XQ ensures the highest level of encryption, dynamic key management, and access control. By securing critical data with FIPS 140-2 compliant encryption, XQ helps prevent major breaches that could cause severe harm to organizational operations or national security.
How XQ Facilitates FIPS 199 Compliance:
- Security Categorization: XQ assists in protecting data across all impact levels by encrypting data and controlling access based on predefined security policies.
- Granular Control: With XQ’s policy-based encryption, organizations can enforce appropriate security measures that align with the impact level assigned to the system.
- Continuous Monitoring: XQ provides real-time logging and monitoring of encryption and decryption activities, supporting ongoing compliance with FIPS 199 requirements.
Frequently asked questions
What is FIPS 199?
FIPS 199 is the federal standard agencies use to categorize information systems by the potential impact of a security breach. Systems are rated low, moderate or high impact across three security objectives: confidentiality, integrity and availability. That categorization then drives how strongly the information within each system must be protected.
How does XQ support confidentiality, integrity and availability under FIPS 199?
XQ supports all three FIPS 199 objectives at the data level. For confidentiality, XQ encrypts data at rest, in transit and during remote access with FIPS 140-2 aligned algorithms. For integrity, XQ embeds encryption policies into the data so tampering is detectable. For availability, XQ manages keys with defined expiration and policy-based controls so authorized users keep access.
How does XQ apply protection differently for low, moderate and high impact systems?
XQ scales protection to the FIPS 199 impact level assigned to a system. For low impact systems it provides file-level encryption, for moderate impact systems it enforces stricter access controls and encryption policies, and for high impact systems it applies its strongest encryption, dynamic key management and access control. XQ secures the data inside these systems rather than managing the system infrastructure itself.
Can XQ's keystore be deployed in disconnected environments?
Yes, XQ's keystore can be deployed as a SaaS offering or on-premises, including within disconnected environments. These deployment options let XQ meet a customer's availability requirements, which is one of the three FIPS 199 security objectives. XQ also provides real-time logging and monitoring of encryption and decryption activity to support ongoing oversight.