locations within organizational information systems.”
NIST SP 800-53, Recommended Security Controls for Federal Information
Systems, elaborates on the FIPS 200 requirements, but it does not represent a
policy or mandated standard.