Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.1 Controls and Oversight > C.2.1.1 Corrective Action Information Type

C.2.1.1 Corrective Action Information Type

Corrective Action involves the enforcement functions necessary to remedy programs that have
been found non-compliant with a given law, regulation, or policy. The recommended security
categorization for the corrective action information type is as follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of corrective action
information on the ability of responsible agencies to remedy internal or external programs that
have been found non-compliant with a given law, regulation, or policy. Unauthorized disclosure
of most corrective action information should have only a limited adverse effect on agency
operations, assets, or individuals.
11 The confidentiality impact assigned to the Information Management Information Type may necessitate the highest
confidentiality impact of the information types processed by the system.
12 A national security system is any information system (including any telecommunications system) used or
operated by an agency or by a contractor on behalf of an agency, or any other organization on behalf of an agency -
(i) the function, operation, or use of which: involves intelligence activities; involves cryptologic activities related to
national security; involves command and control of military forces; involves equipment that is an integral part of a
weapon or weapon system; or is critical to the direct fulfillment of military or intelligence missions (excluding a
routine administrative or business applications system used for applications such as payroll, finance, logistics, and
personnel management); or (ii) that processes classified information.
Special Factors Affecting Confidentiality Impact Determination: Where more sensitive information is
involved, it will probably be personal information subject to the Privacy Act of 1974 or
information that is proprietary to a corporation or other organization. Such information will often
be assigned a moderate confidentiality impact level. The Privacy Act Information provisional
impact levels are documented in the Personal Identity and Authentication information type.
Additionally, there are legislative mandates prohibiting unauthorized disclosure of trade secrets.
Trade secrets will generally be assigned a moderate confidentiality impact level.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for corrective action information is low.
The consequences of undetected unauthorized modification or destruction of corrective action
information can conceivably compromise the effectiveness of compliance enforcement actions
(e.g., by providing violators with a basis for claiming investigative or enforcement irregularities,
thus supporting legal challenges to proposed corrective actions). The integrity impact level is
based on the specific mission and the data supporting that mission, not on the time required to
detect the modification or destruction of information. Unauthorized modification or destruction
of most corrective action information should have only a limited adverse effect on agency
operations, assets, or individuals.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
corrective action information is low.
mission, not on the time required to re-establish access to the corrective action information. The
availability impact is also dependent on whether the data is time-critical. In most cases,
disruption of access to corrective action information can be expected to have only a limited
adverse effect on agency operations, agency assets, or individuals.
Recommended Availability Impact Level: The provisional availability impact level recommended for
corrective action information is low.