ezesecops/rmf-ato-core huggingface dataset:
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
I N F O R M A T I O N S E C U R I T Y > Acknowledgements

Acknowledgements

The authors, Kevin Stine, Rich Kissel, and William C. Barker, wish to thank their colleagues,
Jim Fahlsing and Jessica Gulick from Science Applications International Corporation (SAIC),
who helped update this document, prepare drafts, and review materials. In addition, special
thanks are due to our reviewers, Arnold Johnson (NIST), Karen Quigg (Mitre Corporation), and
Ruth Bandler (Food and Drug Administration), who greatly contributed to the document's
development. A special note of thanks goes to Elizabeth Lennon for her superb technical editing
and administrative support. NIST also gratefully acknowledges and appreciates the many
contributions from individuals in the public and private sectors whose thoughtful and
constructive comments improved the quality and usefulness of this publication.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.4 Step 4: Assign System Security Category > Aggregation

Aggregation

Some information may have little or no sensitivity in isolation but may be highly sensitive in
aggregation. In some cases, aggregation of large quantities of a single information type can
reveal sensitive patterns and plans, or facilitate access to sensitive or critical systems. In other
cases, aggregation of information of several different and seemingly innocuous types can have
similar effects. In general, the sensitivity of a given data element is likely to be greater in
context than in isolation (e.g., association of an account number with the identity of an individual
and/or institution). The availability, routine operational employment, and sophistication of data
aggregation and inference tools are all increasing rapidly. If review reveals increased sensitivity
or criticality associated with information aggregates, then the system security objective impact
levels may need to be adjusted to a higher level than would be indicated by the security impact
levels associated with any individual information type. This could be implemented by
incorporating a statement that explains the aggregation and potential security objective affected
as well as the modification to impact levels.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
APPENDIX B: REFERENCES

APPENDIX B: REFERENCES

S. 3418 [5 U.S.C. § 552A through Public Law 93-579], 93rd U.S. Cong., 2d Sess., The Privacy
Act of 1974, December 31, 1974 (effective September 27, 1975).
S. 244 [Public Law 104-13], 104th U.S. Cong., 1t Sess., Paperwork Reduction Act of 1995, May
22, 1995.
S. 1124, Division E [Public Law 104-106], 104th U.S. Cong., 2d Sess., Information Technology
Management Reform Act of 1996, February 10, 1996.
H.R. 3162, Titles VII and Title IX [Public Law 107-56], 107th U.S. Cong., 1t Sess., The USA
PATRIOT Act of 2001, October 26, 2001.
Public Law 107-296, Critical Information Infrastructure Act of 2002, §§211-215, November 25,
2002.
H.R. 2458 [Public Law 107-347], 107th U.S. Cong., 2d Sess., E-Government Act of 2002,
December 17, 2002.
H.R. 2458, Title III [Public Law 107-347], 107th U.S. Cong., 2d Sess., Federal Information
Security Management Act of 2002, December 17, 2002.
Executive Office of the President, Presidential Decision Directive 63, Protecting America's
Critical Infrastructures, May 22, 1998.
United States Office of Management and Budget, Circular No. A-130, Appendix III, Transmittal
Memorandum #4, Management of Federal Information Resources, November 2000.
United States Office of Management and Budget, OMB Guidance for Implementing the Privacy
Provisions of the E-Government Act of 2002, September 29, 2003.
United States Office of Management and Budget (OMB), Federal Enterprise Architecture (FEA)
Program Management Office (PMO), FEA Consolidated Reference Model 2.3, October 2007.
Federal Information Processing Standards Publication 199, Standards for Security
Categorization of Federal Information and Information Systems, December 2003.
Federal Information Processing Standards Publication 200, Minimum Security Requirements for
Federal Information and Information Systems, March 2006.
Publication 800-18, Guide for Developing Security Plans for Federal Information Systems,
Revision 1, February 2006.
Special Publication 800-30, Risk Management Guide for Information Technology Systems,
July 2002.
Publication 800-34, Contingency Planning Guide for Information Technology Systems, June
2002.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and

Appendix D, "Examples of Impact Determination for Mission-based Information and

Information Systems."
Implementation Tip
At the agency level, all government agencies perform at least one of the
mission areas and employ at least one of the services delivery
mechanisms described in Table 4. However, some information systems
may only provide a supporting role to the agency's mission and not
directly process any of the mission-based information types.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
I N F O R M A T I O N S E C U R I T Y > Authority

Authority

(NIST) to further its statutory responsibilities under the Federal Information Security
Management Act (FISMA) of 2002, P.L. 107-347. NIST is responsible for developing standards
and guidelines, including minimum requirements, for providing adequate information security
for all agency operations and assets but such standards and guidelines shall not apply to national
security systems. This guideline is consistent with the requirements of the Office of Management
and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems, as
analyzed in A-130, Appendix IV: Analysis of Key Sections. Supplemental information is
provided in A-130, Appendix III.
This guideline has been prepared for use by federal agencies. It may also be used by
nongovernmental organizations on a voluntary basis and is not subject to copyright. (Attribution
would be appreciated by NIST.)
Nothing in this document should be taken to contradict standards and guidelines made
mandatory and binding on federal agencies by the Secretary of Commerce under statutory
authority. Nor should these guidelines be interpreted as altering or superseding the existing
authorities of the Secretary of Commerce, Director of the OMB, or any other federal official.
NIST Special Publication 800-60 Volume I, Revision 1, 53 pages
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.2 Step 2: Select Provisional Impact Level > Availability Factors

Availability Factors

Using the FIPS 199 potential impact criteria summarized in Table 7, each information type
should be evaluated for availability with respect to the impact level associated with the
disruption of access to or use of information of (i) each known variant of the information
belonging to the type and (ii) each use of the information by the system under review. Answers
to the following questions will help in the evaluation process:
• How can a malicious adversary use the disruption of access to or use of information to do
limited/serious/severe harm to agency operations, agency assets, or individuals?
• Would disruption of access to or use of elements of the information type violate laws,
executive orders, or agency regulations?
For many information types and information systems, the availability impact level depends on
how long the information or system remains unavailable. Undetected loss of availability can be
catastrophic for many information types. For example, permanent loss of budget execution,
contingency planning, continuity of operations, service recovery, debt collection, taxation
management, personnel management, payroll management, security management, inventory
control, logistics management, or accounting information databases would be catastrophic for
almost any agency. Complete reconstruction of such databases would be time consuming and
expensive.
In most cases, the adverse effects of a limited-duration availability compromise on an
organization's mission functions and public confidence will be limited. In contrast, for time-
critical information types, availability is less likely to be restored before serious harm is done to
agency assets, operations, or personnel (or to public welfare). In such instances, the documented
availability impact level recommendations should indicate the information is time-critical and
the basis for criticality.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
APPENDIX B: REFERENCES > B-2

B-2

Publication 800-37, Guide for the Security Certification and Accreditation of Federal
Information Systems, May 2004.
Special Publication 800-39, Draft Managing Risk from Information Systems: An
Organizational Perspective, April 2008.
Publication 800-53, Recommended Security Controls for Federal Information Systems, Revision
2, December 2007.
Publication 800-53A, Guide for Assessing the Security Controls in Federal Information Systems,
July 2008.
Publication 800-59, Guideline for Identifying an Information System as a National Security
System, August 2003.
Publication 800-64, Security Considerations in the Information System Development Life Cycle,
June 2004.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > C.2.3 Planning & Budgeting

C.2.1 Controls and Oversight

Corrective Action (Policy/Regulation)
Program Evaluation
Program Monitoring

C.2.2 Regulatory Development

Policy & Guidance Development
Public Comment Tracking
Regulatory Creation
Rule Publication

C.2.3 Planning & Budgeting

Budget Formulation
Capital Planning
Enterprise Architecture
Strategic Planning
Budget Execution
Workforce Planning
Management Improvement
Budgeting & Performance Integration
Tax & Fiscal Policy
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > C.2.8 General Government

C.2.4 Internal Risk Management &

Mitigation
Contingency Planning
Continuity of Operations
Service Recovery

C.2.5 Revenue Collection

Debt Collection
User Fee Collection
Federal Asset Sales

C.2.6 Public Affairs

Customer Services
Official Information Dissemination
Product Outreach
Public Relations

C.2.7 Legislative Relations

Legislation Tracking
Legislation Testimony
Proposal Development
Congressional Liaison Operations

C.2.8 General Government

Central Fiscal Operations
Legislative Functions
Executive Functions
Central Property Management
Central Personnel Management
Taxation Management
Central Records & Statistics
Management
Income Information
Personal Identity and Authentication
Entitlement Event Information
Representative Payee Information
General Information
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > C.3.3 Human Resource Management

C.3.1 Administrative Management

Facilities, Fleet, and Equipment
Management
Help Desk Services
Security Management
Travel
Workplace Policy Development &
Management

C.3.2 Financial Management

Accounting
Funds Control
Payments
Collections and Receivables
Asset and Liability Management
Reporting and Information
Cost Accounting/ Performance
Measurement

C.3.3 Human Resource Management

HR Strategy
Staff Acquisition
Organization & Position Mgmt
Compensation Management
Benefits Management
Employee Performance Mgmt
Employee Relations
Labor Relations
Separation Management
Human Resources Development
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > C.3.5 Information & Technology

C.3.4 Supply Chain Management

Goods Acquisition
Inventory Control
Logistics Management
Services Acquisition

C.3.5 Information & Technology

Management
System Development
Lifecycle/Change Management
System Maintenance
IT Infrastructure Maintenance
Information Security
Record Retention
Information Management
System and Network Monitoring
Information Sharing
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.4 Step 4: Assign System Security Category > Catastrophic Loss of System Availability

Catastrophic Loss of System Availability

Either physical or logical destruction of major assets can result in very large expenditures to
restore the assets and/or long periods of time for recovery. Permanent loss/unavailability of
information system capabilities can seriously hamper agency operations and, where direct
services to the public are involved, have a severe adverse effect on public confidence in Federal
agencies. Particularly in the case of large systems, FIPS 199 criteria suggest that catastrophic
loss of system availability may result in a high availability impact level. Whether or not the
impact level of system availability should be high (and subsequent high system security impact
level) is dependent on other factors, such as cost and criticality of the system, rather than on the
security impact levels for the information types being processed by the system.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.2 Step 2: Select Provisional Impact Level > Confidentiality Factors

Confidentiality Factors

Using the FIPS 199 potential impact criteria summarized in Table 7, each information type
should be evaluated for confidentiality with respect to the impact level associated with
unauthorized disclosure of (i) each known variant of the information belonging to the type and
(ii) each use of the information by the system under review. Answers to the following questions
will help in the evaluation process:
• How can a malicious adversary use the unauthorized disclosure of information to do
limited/serious/severe harm to agency operations, agency assets, or individuals?
• How can a malicious adversary use the unauthorized disclosure of information to gain
control of agency assets that might result in unauthorized modification of information,
destruction of information, or denial of system services that would result in
limited/serious/severe harm to agency operations, agency assets, or individuals?
• Would unauthorized disclosure/dissemination of elements of the information type violate
laws, executive orders, or agency regulations?
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.4 Step 4: Assign System Security Category > Critical Infrastructures and Key Resources

Critical Infrastructures and Key Resources

Where the mission served by an information system, or the information that the system
processes, affects the security of critical infrastructures and key resources, the harm that results
from a compromise requires particularly close attention. In this case, an effect on security might
include a significant reduction in the effectiveness of physical or cyber security protection
mechanisms, or facilitation of a terrorist attack on critical infrastructures and key resources.
Accordingly, the system security categorization should be carefully determined when a loss of
confidentiality, integrity, or availability will result in a negative impact on the critical
infrastructures and key resources.
The Critical Information Infrastructure Act of 2002, Public Law 107-296 §§ 211-215 of
November 25, 2002 (codified as 6 U.S.C. 131-134), defines the term "critical infrastructure
information" to mean information not customarily in the public domain and related to the
security of critical infrastructure or protected systems. Should information types be aligned with
Critical Infrastructures, then action should be taken to ensure compliance with Homeland
Security Presidential Directive No. 7 (HSPD 7) and to initiate an interdependency analysis.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.4 Step 4: Assign System Security Category > Critical System Functionality

Critical System Functionality

Compromise of some information types may have low impact in the context of a system's
primary function but may have much more significance when viewed in the context of the
potential impact of compromising:
• Other systems to which the system in question is connected, or
• Other systems which are dependent on that system's information.
Access control information for a system that processes only low impact information might
initially be thought to have only low impact security objectives. However, if access to that
system might result in some form of access to other systems (e.g., over a network), the sensitivity
and criticality attributes of all systems to which such indirect access can result needs to be
considered. Similarly, some information may, in general, have low sensitivity and/or criticality
security objectives. However, that information may be used by other systems to enable
extremely sensitive or critical functions (e.g., air traffic control use of weather information or use
of commercial flight information to identify military combat transport systems). Loss of data
integrity, availability, temporal context, or other context can have catastrophic consequences.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
D.16 Law Enforcement

D.1 Defense & National Security

Strategic National & Theater Defense
Operational Defense
Tactical Defense

D.2 Homeland Security

Border and Transportation Security
Key Asset and Critical Infrastructure
Protection
Catastrophic Defense
Executive Functions of the Executive
Office of the President (EOP)

D.3 Intelligence Operations

Intelligence Planning
Intelligence Collection
Intelligence Analysis & Production
Intelligence Dissemination
Intelligence Processing

D.4 Disaster Management

Disaster Monitoring and Prediction
Disaster Preparedness and Planning
Disaster Repair and Restoration
Emergency Response

D.5 International Affairs &

Commerce
Foreign Affairs
International Development and
Humanitarian Aid
Global Trade

D.6 Natural Resources

Water Resource Management
Conservation, Marine and Land
Management
Recreational Resource Management and
Tourism
Agricultural Innovation and Services

D.7 Energy

Energy Supply
Energy Conservation and Preparedness
Energy Resource Management
Energy Production

D.8 Environmental Management

Environmental Monitoring and
Forecasting
Environmental Remediation
Pollution Prevention and Control

D.9 Economic Development

Business and Industry Development
Intellectual Property Protection
Financial Sector Oversight
Industry Sector Income Stabilization

D.10 Community & Social Services

Homeownership Promotion
Community and Regional Development
Social Services
Postal Services

D.11 Transportation

Ground Transportation
Water Transportation
Air Transportation
Space Operations

D.12 Education

Elementary, Secondary, and Vocational
Education
Higher Education
Cultural and Historic Preservation
Cultural and Historic Exhibition

D.13 Workforce Management

Training and Employment
Labor Rights Management
Worker Safety

D.14 Health

Access to Care
Population Health Mgmt & Consumer
Safety
Health Care Administration
Health Care Delivery Services
Health Care Research and Practitioner
Education

D.15 Income Security

General Retirement and Disability
Unemployment Compensation
Housing Assistance
Food and Nutrition Assistance
Survivor Compensation

D.16 Law Enforcement

Criminal Apprehension
Criminal Investigation and Surveillance
Citizen Protection
Leadership Protection
Property Protection
Substance Control
Crime Prevention
Trade Law Enforcement
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
D.19 General Sciences & Innovation

D.17 Litigation & Judicial Activities

Judicial Hearings
Legal Defense
Legal Investigation
Legal Prosecution and Litigation
Resolution Facilitation

D.18 Federal Correctional Activities

Criminal Incarceration
Criminal Rehabilitation

D.19 General Sciences & Innovation

Scientific and Technological Research
and Innovation
Space Exploration and Innovation
14 The recommended information types provided in NIST SP 800-60 are established from the "business areas"
and "lines of business" from OMB's Business Reference Model (BRM) section of Federal Enterprise
Architecture (FEA) Consolidated Reference Model Document Version 2.3, October 2007.
Table 4: Mission-Based Information Types and Delivery Mechanisms14
Services Delivery Mechanisms and Information Types [Mode of Delivery]
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
D.26 Direct Services for Citizens

D.20 Knowledge Creation &

Management
Research and Development
General Purpose Data and Statistics
Advising and Consulting
Knowledge Dissemination

D.21 Regulatory Compliance &

Enforcement
Inspections and Auditing
Standards Setting/Reporting Guideline
Development
Permits and Licensing

D.22 Public Goods Creation &

Management
Manufacturing
Construction
Public Resources, Facility and
Infrastructure Management
Information Infrastructure Management

D.23 Federal Financial Assistance

Federal Grants (Non-State)
Direct Transfers to Individuals
Subsidies
Tax Credits

D.24 Credit and Insurance

Direct Loans
Loan Guarantees
General Insurance

D.25 Transfers to State/ Local

Governments
Formula Grants
Project/Competitive Grants
Earmarked Grants
State Loans

D.26 Direct Services for Citizens

Military Operations
Civilian Operations
The approach to establishing mission-based information types at an agency level begins by
documenting the agency's business and mission areas. The owner, or designee, of each
information system is responsible for identifying the information types stored in, processed by,
or generated by that information system. In the case of mission-based information, the
responsible individuals, in coordination with management, operational, and security
stakeholders, should compile a comprehensive set of lines of business and mission areas
conducted by the agency. In addition, the responsible individuals should identify the applicable
sub-functions necessary to conduct agency business and in turn accomplish the agency's
mission. For example, one mission conducted by an agency might be law enforcement. Sub-
functions that are part of the agency's law enforcement mission might include criminal
investigation and surveillance, criminal apprehension, criminal incarceration, citizen protection,
crime prevention, and property protection. Each of these sub-functions would represent an
information type.
Recommended mission-based lines of business and constituent sub-functions that may be
processed by information systems are identified in Table 4 with details provided in Volume II,