Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.2 Financial Management > C.3.2.2 Reporting and Information Information Type

C.3.2.2 Reporting and Information Information Type

Reporting and Information includes providing financial information, reporting and analysis of
financial transactions. Financial reporting includes the activities necessary to support:
management's fiduciary role; budget formulation and execution functions; fiscal management of
program delivery and program decision making; and internal and external reporting
requirements. The recommended security categorization for the "financial reporting and
information" information type is as follows:
Security Category = {(confidentiality, Low), (integrity, Moderate), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of financial reporting
information on an agency's ability to provide financial information and reporting and analysis of
financial transactions. Typically, the unauthorized disclosure of financial reporting information
will have only a limited adverse effect on agency operations, assets, or individuals.
Special Factors Affecting Confidentiality Impact Determination: Unauthorized disclosure of financial
reporting information for programs that process high-impact information can give adversaries
damaging insights into details of agency plans, priorities, and operations. In relatively rare cases,
actions taken based on unauthorized disclosure of financial reporting details pose a threat to
human life or a loss of major assets, so the confidentiality impact is high.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for reporting and information is low.
not on the time required to detect the modification or destruction of information. Financial
reporting activities are not generally time-critical. Many integrity compromises would result in
limited adverse effects on agency operations, agency assets, or individuals.
If planning documents, proposals, or reports based on modified or incomplete information are
circulated; the adverse effect on mission functions or public confidence in the agency can be
serious. In most cases, serious adverse effects on agency operations, agency assets, or
individuals can be expected. The extensive audit and investigative actions that often follow
discovery of an agency's use of falsified financial reports or omission of financial reporting data
can place the agency at a significant disadvantage.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
reporting and information is moderate.
mission, not on the time required to re-establish access to the assets and liability management
information. Financial reporting processes are generally tolerant of delay. Typically, disruption
of access to financial reporting information can be expected to have only a limited adverse effect
on agency operations, agency assets, or individuals.
Recommended Availability Impact Level: The provisional availability impact recommended for
reporting and information is low.