Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
3.2 Impact Assessment

3.2 Impact Assessment

FIPS 199 defines three levels of potential impact on organizations or individuals should there be
a breach of security (i.e., a loss of confidentiality, integrity, or availability). The application of
these definitions must take place within the context of each organization and the overall national
interest. Table 2 provides FIPS 199 potential impact definitions.
Table 2: Potential Impact Levels
Potential
Impact
Definitions
Low
The potential impact is low if-The loss of confidentiality, integrity, or availability could be
expected to have a limited adverse effect on organizational operations, organizational assets, or
individuals.7
A limited adverse effect means that, for example, the loss of confidentiality, integrity, or
availability might: (i) cause a degradation in mission capability to an extent and duration that the
organization is able to perform its primary functions, but the effectiveness of the functions is
noticeably reduced; (ii) result in minor damage to organizational assets; (iii) result in minor
financial loss; or (iv) result in minor harm to individuals.
Moderate
The potential impact is moderate if-The loss of confidentiality, integrity, or availability could be
expected to have a serious adverse effect on organizational operations, organizational assets, or
individuals.
A serious adverse effect means that, for example, the loss of confidentiality, integrity, or
availability might: (i) cause a significant degradation in mission capability to an extent and duration
that the organization is able to perform its primary functions, but the effectiveness of the functions
is significantly reduced; (ii) result in significant damage to organizational assets; (iii) result in
significant financial loss; or (iv) result in significant harm to individuals that does not involve loss
of life or serious life threatening injuries.
High
The potential impact is high if-The loss of confidentiality, integrity, or availability could be
expected to have a severe or catastrophic adverse effect on organizational operations,
organizational assets, or individuals.
A severe or catastrophic adverse effect means that, for example, the loss of confidentiality,
integrity, or availability might: (i) cause a severe degradation in or loss of mission capability to an
extent and duration that the organization is not able to perform one or more of its primary
functions; (ii) result in major damage to organizational assets; (iii) result in major financial loss; or
(iv) result in severe or catastrophic harm to individuals involving loss of life or serious life
threatening injuries.
In FIPS 199, the security category of an information type can be associated with both user
information and system information8 and can be applicable to information in either electronic or
non-electronic form. It is also used as input in considering the appropriate security category for
a system. Establishing an appropriate security category for an information type simply requires
determining the potential impact for each security objective associated with the particular
information type. The generalized format for expressing the security category, or SC, of an
information type is:
7 Adverse effects on individuals may include, but are not limited to, loss of the privacy to which individuals are
entitled under law.
8 System information (e.g., network routing tables, password files, cryptographic key management information)
must be protected at a level commensurate with the most critical or sensitive user information being processed
by the information system to ensure confidentiality, integrity, and availability.
Security Category information type = {(confidentiality, impact), (integrity, impact), (availability,
impact)}
where the acceptable values for potential impact are low, moderate, high, or not applicable.9
9 The potential impact value of not applicable may be applied only to the confidentiality security objective.