FIPS 199 and Boundary

The FIPS 199 categorization determines the impact level for the whole system. Use the high-water mark across confidentiality, integrity, and availability, then make the authorization boundary match that decision.

Impact Categorization

Security Objective	Low Impact Case	Moderate Impact Case	High Impact Case	Current Assessment
Confidentiality	Unauthorized disclosure causes limited adverse effect.	Unauthorized disclosure causes serious adverse effect, including regulated PII or sensitive government workflow data.	Unauthorized disclosure causes severe or catastrophic effect, including law enforcement, emergency, health, financial, or other high-impact data.	[FILL IN]
Integrity	Unauthorized modification causes limited adverse effect.	Unauthorized modification causes serious mission, financial, legal, or operational harm.	Unauthorized modification causes severe mission failure, public safety harm, or catastrophic financial harm.	[FILL IN]
Availability	Disruption causes limited adverse effect.	Disruption causes serious degradation of government service delivery.	Disruption causes severe mission failure or public safety risk.	[FILL IN]

Baseline Decision

Field	Value
High-water mark	[FILL IN: Low, Moderate, or High]
Recommended FedRAMP baseline	[FILL IN: Low, Li-SaaS, Moderate, or High]
Baseline rationale	[FILL IN: concise rationale tied to data and mission impact]
Decision owner	[FILL IN]
Decision date	[FILL IN]
Revisit cadence	At least annually and after significant data, architecture, mission, or customer changes.

Data Inventory

Data Type	Example	Source	Storage Location	External Sharing	Impact Driver
Public product content	Documentation and marketing pages	Internal authors	Static hosting and repository	Public	Low confidentiality
Account data	User identity, roles, email, audit metadata	Users and IdP	Application database and IdP	Limited subprocessors	Moderate confidentiality
Government workflow data	[FILL IN]	[FILL IN]	[FILL IN]	[FILL IN]	[FILL IN]
Audit logs	Login, admin, configuration, release, and data-access events	Application, GitHub, Kubernetes, Argo CD	Log store and object storage	3PAO and agency review	Integrity and accountability
Secrets	API keys, tokens, credentials, signing keys	Secret manager and CI/CD	Secret manager, KMS, CI secrets	No external sharing	High control sensitivity

Authorization Boundary

In Boundary

Component	Technology	Owner	Evidence
Web application	React, Astro SSR, @dmwd-io/design-system	Application Engineering	Build logs, tests, accessibility results, release artifacts
API services	Go Fiber and TypeScript endpoints	Application Engineering	API tests, OpenAPI contracts, audit events
Data stores	Postgres and SQLite where approved	Platform Engineering	Encryption settings, backups, access grants
Kubernetes runtime	Kubernetes, Helm, Argo CD	Platform Engineering	Cluster policy reports, sync history, admission policy results
CI/CD	GitHub Actions	Platform Engineering	Workflow logs, approvals, SARIF, signed artifacts
Observability	OpenTelemetry, Prometheus, logs, dashboards	Platform Engineering	Dashboards, alert history, retention exports

External or Inherited

Service	Relationship	Inherited Controls	Evidence Needed
Cloud provider	Infrastructure hosting	Physical security, facility, selected platform controls	FedRAMP package or responsibility matrix
GitHub	Source control and CI/CD	Repository access, audit logs, workflow controls where configured	Enterprise audit exports, branch protection screenshots or API exports
Identity provider	Workforce and customer identity	MFA, federation, lifecycle where configured	IdP policy export, access review evidence
Secret manager	Secret storage and rotation	Secret encryption, access logging, rotation support	Configuration export and access logs
Email or notification service	Transactional messaging	Message delivery and provider security controls	Data-processing and authorization evidence

Boundary Diagram Placeholder

Add a diagram after the boundary is stable. The diagram should show users, IdP, browser, application, API services, databases, object storage, Kubernetes, CI/CD, logging, monitoring, backup storage, external services, and every trust boundary.

Data Flow Checklist

• Browser to web application flow documented.
• Web application to API flow documented.
• API to database flow documented.
• API to external service flow documented.
• CI/CD to registry and Kubernetes flow documented.
• Logging and audit-event flow documented.
• Backup and restore flow documented.
• Administrative access flow documented.
• Break-glass access flow documented.
• Data export and deletion flow documented.

Boundary Control Questions

Question	Answer
Which users can enter the boundary?	[FILL IN]
Which administrators can change production?	[FILL IN]
Which systems can call production APIs?	[FILL IN]
Which data leaves the boundary?	[FILL IN]
Which controls are inherited from hosting providers?	[FILL IN]
Which controls are inherited from identity, source control, or CI/CD providers?	[FILL IN]
Which controls are fully implemented by dmwd.io?	[FILL IN]
Which controls are shared?	[FILL IN]