Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.3 Human Resource Management > C.3.3.4 Compensation Management Information Type

C.3.3.4 Compensation Management Information Type

Compensation Management designs, develops, and implements compensation programs that
attract, retain and fairly compensate agency employees. In addition, designs, develops, and
implements pay for performance compensation programs to recognize and reward high
performance, with both base pay increases and performance bonus payments. This sub-function
includes: developing and implementing compensation programs; administering bonus and
monetary awards programs; administering pay changes; managing time, attendance, leave and
pay; and managing payroll. The recommended provisional security categorization for
compensation management information is as follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of compensation
management information on the ability of responsible agencies to design, develop, and
implements compensation programs that attract, retain and fairly compensate agency employees
will have only a limited adverse effect on agency operations, assets, or individuals.
Special Factors Affecting Confidentiality Impact Determination: Where more sensitive information is
involved, it will probably be personal information subject to the Privacy Act of 1974. The
Privacy Act Information provisional impact levels are documented in the Personal Identity and
Authentication information type. In a few cases (e.g., where some employees are potential
targets for retaliation by criminal elements or targets of foreign intelligence organizations),
unauthorized disclosure of some compensation management information (e.g., name, address,
title, organization, dependents' information) can have life-threatening consequences and has a
high confidentiality impact level.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for disclosure compensation management information is low.
not on the time required to detect the modification or destruction of information. Compensation
management activities are not generally time-critical.
Special Factors Affecting Integrity Impact Determination: An accumulation of small changes to data
or deletion of small entries can result in excessive disbursements of payroll, bonus and monetary
awards or affects pay changes, time and attendance, etc. In some cases, the adverse effects of
consequent negative publicity on mission functions or public confidence in the agency can be
serious. In some other cases, integrity compromises that adversely affect a significant subset of
the workforce can result in staff issues and work stoppages that adversely affect the agency's
mission. Where interruptions to agency missions can have serious or life-threatening
consequences for individuals, the impacts of integrity compromises can be moderate or even
high.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
compensation management information is low.
mission, not on the time required to re-establish access to compensation management
information. Compensation management processes are generally tolerant of delay. Typically,
disruption compensation management information can be expected to have only a limited
adverse effect on agency operations, agency assets, or individuals.
Recommended Availability Impact Level: The provisional availability impact level recommended
compensation management information is low.