ezesecops/rmf-ato-core huggingface dataset:
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.2 Step 2: Select Provisional Impact Level

4.2 Step 2: Select Provisional Impact Level

In Step 2, organizations should establish provisional impact levels17 based on the identified
information types in Step 1. The provisional impact levels are the original impact levels
assigned to the confidentiality, integrity, and availability security objectives of an information
type from Volume II before any adjustments are made. Also in this step, the initial security
categorization for the information type is established and documented.
Volume II, Appendix C suggests provisional confidentiality, integrity, and availability impact
levels for management and support information types, and Volume II, Appendix D provides
examples of provisional impact level assignments for mission-based information types. Using
the impact assessment criteria identified in Section 3.2 for the security objectives and types of
potential losses identified in Section 3.1.2, the organizational entity responsible for impact
determination must assign impact levels and consequent security categorization for the mission-
based and management and support information types identified for each information system.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.2 Step 2: Select Provisional Impact Level > 4.2.2 Common Factors for Selection of Impact Levels

4.2.2 Common Factors for Selection of Impact Levels

Where an agency determines security impact levels and security categorization based on local
application of FIPS 199 criteria, it is recommended that the following factors be considered with
respect to security impacts for each information type.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.2 Step 2: Select Provisional Impact Level > 4.2.3 Examples of FIPS 199-Based Selection of Impact Levels

4.2.3 Examples of FIPS 199-Based Selection of Impact Levels

FIPS 199-based examples of security objective impact selection and security categorization for
sample information types follow:
EXAMPLE 1: An organization managing public information on its web server determines that
there is no potential impact from a loss of confidentiality (i.e., confidentiality requirements are
not applicable), a moderate potential impact from a loss of integrity, and a moderate potential
impact from a loss of availability. The resulting security category of this information type is
expressed as:
Security Category public information = {(confidentiality, n/a), (integrity, moderate), (availability,
moderate)}.
EXAMPLE 2: A law enforcement organization managing extremely sensitive investigative
information determines that the potential impact from a loss of confidentiality is high, the
potential impact from a loss of integrity is moderate, and the potential impact from a loss of
availability is moderate. The resulting security category for this type of information is expressed
as:
Security Category investigative information = {(confidentiality, high), (integrity, moderate), (availability,
moderate)}.
EXAMPLE 3: A financial organization managing routine administrative information (not privacy-
related information) determines that the potential impact from a loss of confidentiality is low, the
potential impact from a loss of integrity is low, and the potential impact from a loss of
availability is low. The resulting security category of this information type is expressed as:
Security Category administrative information = {(confidentiality, low), (integrity, low), (availability, low)}.
In general, security objective impact assessment is independent of mechanisms employed to
mitigate the consequences of a compromise.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.4 Step 4: Assign System Security Category

4.4 Step 4: Assign System Security Category

Once the security impact levels have been selected, reviewed and adjusted as necessary for the
security objectives of each individual information type processed by an information system, it is
necessary to assign a system security category based on the aggregate of information types. The
Step 4 activities include the following: (i) review identified security categorizations for the
aggregate of information types; (ii) determine the system security categorization by identifying
the high water mark for each of the security objectives (confidentiality, integrity, availability)
based on the aggregate of the information types; (iii) adjust the high water mark for each system
security objective, as necessary, by applying the factors discussed in section 4.4.2; (iv) assign the
overall information system impact level based on the highest impact level for the system security
objectives; and (v) document all security categorization determinations and decisions.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.4 Step 4: Assign System Security Category > 4.4.2 Guidelines for System Categorization

4.4.2 Guidelines for System Categorization

In some cases, the impact level for a system security category will be higher than any security
objective impact level for any information type processed by the system.
The primary factors that most commonly raise the impact levels of the system security category
above that of its constituent information types are aggregation and critical system functionality.
Additionally, variations in sensitivity/criticality with respect to time may need to be factored into
the impact assignment process. Some information loses its sensitivity in time (e.g.,
economic/commodity projections after they've been published). Other information is
particularly critical at some point in time (e.g., weather data in the terminal approach area during
aircraft landing operations). This section provides some general guidelines regarding how
aggregation, critical functionality, and other system factors may affect system security
categorization.
Implementation Tip
Agency personnel should be aware that there are several factors that
should be considered during the aggregation of system information
types. When considering these factors, previously unforeseen concerns
may surface affecting the confidentiality, integrity, and/or availability
impact levels at the system level. These factors include data
aggregation, critical system functionality, extenuating circumstances,
and other system factors.
In order to effectively accomplish this step, various stakeholders (e.g., management, operational
personnel, or security experts) may need to be involved in decisions regarding system-level
impact assessments. The following sections provide factors to consider in adjusting the system
security objective impact levels.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.4 Step 4: Assign System Security Category > 4.4.3 Overall Information System Impact

4.4.3 Overall Information System Impact

Since the impact values (i.e., levels) for confidentiality, integrity, and availability may not
always be the same for a particular information system, the high water mark concept20 is used to
19 The OMB definition of an individual is, "a citizen of the United States or an alien lawfully admitted for
permanent residence." Agencies may choose to extend the protections of the Privacy Act and E-Government
Act to businesses, sole proprietors, aliens, etc.
determine the overall impact level of the information system. The security impact level for an
information system will generally be the highest impact level for the security objectives
(confidentiality, integrity, and availability) associated with the aggregate of system information
types. Thus, a low-impact system is defined as an information system in which all three of the
security objectives are low. A moderate-impact system is an information system in which at least
one of the security objectives is moderate and no security objective is greater than moderate. And
finally, a high-impact system is an information system in which at least one security objective is
high.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.5 Documenting the Security Categorization Process

4.5 Documenting the Security Categorization Process

Essential to the security categorization process is documenting the research, key decisions and
approvals, and supporting rationale driving the information system security categorization. This
information is key to supporting the security life cycle and will need to be included in the
information system's security plan.
Figure 3 provides an example of information details that should be collected.
20 The high water mark concept is employed because there are significant dependencies among the security
objectives of confidentiality, integrity, and availability. In most cases, a compromise in one security objective
ultimately affects the other security objectives as well.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
4009 Adapted]

4009 Adapted]

Potential Impact
The loss of confidentiality, integrity, or availability could be expected to
have: (i) a limited adverse effect (FIPS 199 low); (ii) a serious adverse
effect (FIPS 199 moderate); or (iii) a severe or catastrophic adverse
effect (FIPS 199 high) on organizational operations, organizational
assets, or individuals. [FIPS 199]
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Chapter 91. [41 U.S.C., Sec. 403] > A-1

200, NIST SP 800-37]

Availability
Ensuring timely and reliable access to and use of information. [44
U.S.C., Sec. 3542]

A-1

Business Areas
"Business areas" separate government operations into high-level
categories relating to the purpose of government, the mechanisms the
government uses to achieve its purposes, the support functions necessary
to conduct government operations, and resource management functions
that support all areas of the government's business. "Business areas" are
subdivided into "areas of operation" or "lines of business." The
recommended information types provided in NIST SP 800-60 are
established from the "business areas" and "lines of business" from
OMB's Business Reference Model (BRM) section of Federal Enterprise
Architecture (FEA) Consolidated Reference Model Document Version
2.3
Certification
A comprehensive assessment of the management, operational, and
technical security controls in an information system, made in support of
security accreditation, to determine the extent to which the controls are
implemented correctly, operating as intended, and producing the desired
outcome with respect to meeting the security requirements for the
system. [FIPS 200, NIST SP 800-37]
Chief Information
Officer
Agency official responsible for:
(i) Providing advice and other assistance to the head of the executive
agency and other senior management personnel of the agency to ensure
that information technology is acquired and information resources are
managed in a manner that is consistent with laws, Executive Orders,
directives, policies, regulations, and priorities established by the head of
the agency;
(ii) Developing, maintaining, and facilitating the implementation of a
sound and integrated information technology architecture for the agency;
and
(iii) Promoting the effective and efficient design and operation of all
major information resources management processes for the agency,
including improvements to work processes of the agency. [PL 104-106,
Sec. 5125(b)]
Classified
Information
Information that has been determined pursuant to Executive Order
(E.O.) 13292 or any predecessor order to require protection against
unauthorized disclosure and is marked to indicate its classified status
when in documentary form.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Chapter 91. [41 U.S.C., Sec. 403] > A-2

A-2

Command and
Control
The exercise of authority and direction by a properly designated
commander over assigned and attached forces in the accomplishment of
the mission. Command and control functions are performed through an
arrangement of personnel, equipment, communications, facilities, and
procedures employed by a commander in planning, directing,
coordinating, and controlling forces and operations in the
accomplishment of the mission.
Confidentiality
Preserving authorized restrictions on information access and disclosure,
including means for protecting personal privacy and proprietary
information. [44 U.S.C., Sec. 3542]
Counterintelligence
Information gathered and activities conducted to protect against
espionage, other intelligence activities, sabotage, or assassinations
conducted by or on behalf of foreign governments or elements thereof,
foreign organizations, or foreign persons, or international terrorist
activities.
Criticality
A measure of the degree to which an organization depends
on the information or information system for the success of a mission or
of a business function.
Cryptologic
Of or pertaining to cryptology.
Cryptology
The science that deals with hidden, disguised, or encrypted
communications. It includes communications security and
communications intelligence.
Executive Agency
An executive department specified in 5 U.S.C., Sec. 101; a military
department specified in 5 U.S.C., Sec.102; an independent establishment
as defined in 5 U.S.C., Sec. 104(1); or a wholly owned government
corporation fully subject to the provisions of 31 U.S.C., Chapter 91. [41
U.S.C., Sec. 403]
Federal Enterprise
Architecture
[FEA Program
Management Office]
A business-based framework for government-wide improvement
developed by the Office of Management and Budget that is intended to
facilitate efforts to transform the federal government to one that is
citizen-centered, results-oriented, and market-based.
Federal Information
System
An information system used or operated by an executive agency, by a
contractor of an executive agency, or by another organization on behalf
of an executive agency. [40 U.S.C., Sec. 11331]
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Chapter 91. [41 U.S.C., Sec. 403] > A-3

A-3

General Support
System
An interconnected set of information resources under the same direct
management control that shares common functionality. It normally
includes hardware, software, information, data, applications,
communications, and people. [OMB Circular A-130, Appendix III]
High-Impact System
An information system in which at least one security objective (i.e.,
confidentiality, integrity, or availability) is assigned a FIPS 199 potential
impact value of high. [FIPS 200]
Impact
The magnitude of harm that can be expected to result from the
consequences of unauthorized disclosure of information, unauthorized
modification of information, unauthorized destruction of information, or
loss of information or information system availability.
Independent
Regulatory Agency
The Board of Governors of the Federal Reserve System, the Commodity
Futures Trading Commission, the Consumer Product Safety
Commission, the Federal Communications Commission, the Federal
Deposit Insurance Corporation, the Federal Energy Regulatory
Commission, the Federal Housing Finance Board, the Federal Maritime
Commission, the Federal Trade Commission, the Interstate Commerce
Commission, the Mine Enforcement Safety and Health Review
Commission, the National Labor Relations Board, the Nuclear
Regulatory Commission, the Occupational Safety and Health Review
Commission, the Postal Rate Commission, the Securities and Exchange
Commission, and any other similar agency designated by statute as a
Federal independent regulatory agency or commission.
Individual
A citizen of the United States or an alien lawfully admitted for
permanent residence. Agencies may, consistent with individual practice,
choose to extend the protections of the Privacy Act and E-Government
Act to businesses, sole proprietors, aliens, etc.
Information
An instance of an information type. [FIPS 199]
Information Owner
Official with statutory or operational authority for specified information
and responsibility for establishing the controls for its generation,
collection, processing, dissemination, and disposal. [CNSS Inst. 4009]
Information
Resources
Information and related resources, such as personnel, equipment, funds,
and information technology. [44 U.S.C., Sec. 3502]
Information Security
The protection of information and information systems from
unauthorized access, use, disclosure, disruption, modification, or
destruction in order to provide confidentiality, integrity, and availability.
[44 U.S.C., Sec. 3542]
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Chapter 91. [41 U.S.C., Sec. 403] > A-4

A-4

Information System
A discrete set of information resources organized for the collection,
processing, maintenance, use, sharing, dissemination, or disposition of
information. [44 U.S.C., Sec. 3502; OMB Circular A-130, Appendix
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Chapter 91. [41 U.S.C., Sec. 403] > A-5

A-5

Intelligence
Activities
The term 'intelligence activities' includes all activities that agencies
within the Intelligence Community are authorized to conduct pursuant to
Executive Order 12333, United States Intelligence Activities.
Intelligence
Community
The term 'intelligence community' refers to the following agencies or
organizations:
(i) The Central Intelligence Agency (CIA);
(ii) The National Security Agency (NSA);
(iii) The Defense Intelligence Agency (DIA);
(iv) The offices within the Department of Defense for the collection of
specialized national foreign intelligence through reconnaissance
programs;
(v) The Bureau of Intelligence and Research of the Department of
State;
(vi) The intelligence elements of the Army, Navy, Air Force, and
Marine Corps, the Federal Bureau of Investigation (FBI), the
Department of the Treasury, and the Department of Energy; and
(vii) The staff elements of the Director of Central Intelligence.
Lines of Business
"Lines of business" or "areas of operation" describe the purpose of
government in functional terms or describe the support functions that the
government must conduct in order to effectively deliver services to
citizens. Lines of business relating to the purpose of government and the
mechanisms the government uses to achieve its purposes tend to be
mission-based. Lines of business relating to support functions and
resource management functions that are necessary to conduct
government operations tend to be common to most agencies. The
recommended information types provided in NIST SP 800-60 are
established from the "business areas" and "lines of business" from
OMB's Business Reference Model (BRM) section of Federal Enterprise
Architecture (FEA) Consolidated Reference Model Document Version
2.3
Low-Impact System
An information system in which all three security objectives (i.e.,
confidentiality, integrity, and availability) are assigned a FIPS 199
potential impact value of low. [FIPS 200]
Mission Critical
Any telecommunications or information system that is defined as a
national security system (FISMA) or processes any information the loss,
misuse, disclosure, or unauthorized access to or modification of, would
have a debilitating impact on the mission of an agency.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Chapter 91. [41 U.S.C., Sec. 403] > A-6

A-6

Moderate-Impact
System
An information system in which at least one security objective (i.e.,
confidentiality, integrity, or availability) is assigned a FIPS 199 potential
impact value of moderate and no security objective is assigned a FIPS
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
4009 Adapted] > A-7

A-7

Privacy Impact
Assessment (PIA)
An analysis of how information is handled:
(i)
to ensure handling conforms to applicable legal, regulatory,
and policy requirements regarding privacy;
(ii)
to determine the risks and effects of collecting, maintaining,
and disseminating information in identifiable form in an
electronic information system; and
(iii)
to examine and evaluate protections and alternative processes
for handling information to mitigate potential privacy risks.
[OMB Memorandum 03-22]
Public Information
Any information, regardless of form or format that an agency discloses,
disseminates, or makes available to the public.
Risk
The level of impact on organizational operations (including mission,
functions, image, or reputation), organizational assets, individuals, other
organizations, or the Nation resulting from the operation of an
information system given the potential impact of a threat and the
likelihood of that threat occurring. [FIPS 200, Adapted]
Security Category
The characterization of information or an information system based on
an assessment of the potential impact that a loss of confidentiality,
integrity, or availability of such information or information system
would have on organizational operations, organizational assets,
individuals, other organizations, or the Nation. [FIPS 199, Adapted]
Security Controls
The management, operational, and technical controls (i.e., safeguards or
countermeasures) prescribed for an information system to protect the
confidentiality, integrity, and availability of the system and its
information. [FIPS 199]
Security Objectives
Confidentiality, integrity, and availability.[FIPS 199]
Senior Agency
Information Security
Officer
Official responsible for carrying out the Chief Information Officer
responsibilities under FISMA and serving as the Chief Information
Officer's primary liaison to the agency's authorizing officials,
information system owners, and information system security officers.
[44 U.S.C., Sec. 3544]
Sensitivity
Used in this guideline to mean a measure of the importance assigned to
information by its owner, for the purpose of denoting its need for
protection.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
4009 Adapted] > A-9

A-9

Sub-functions
Sub-functions are the basic operations employed to provide the system
services within each area of operations or line of business. The
recommended information types provided in NIST SP 800-60 are
established from the "business areas" and "lines of business" from
OMB's Business Reference Model (BRM) section of Federal Enterprise
Architecture (FEA) Consolidated Reference Model Document Version
2.3
System
See Information System.
Telecommunications
The transmission, between or among points specified by the user, of
information of the user's choosing, without change in the form or content
of the information as sent and received.
Threat
Any circumstance or event with the potential to adversely impact agency
operations (including mission, functions, image, or reputation), agency
assets, individuals, other organizations, or the Nation through an
information system via unauthorized access, destruction, disclosure,
modification of information, and/or denial of service. [CNSS Inst. 4009,
Adapted]
Vulnerability
Weakness in an information system, system security procedures, internal
controls, or implementation that could be exploited or triggered by a
threat source. [CNSS Inst. 4009, Adapted]
Weapons System
A combination of one or more weapons with all related equipment,
materials, services, personnel, and means of delivery and deployment (if
applicable) required for self-sufficiency.