ezesecops/rmf-ato-core huggingface dataset:
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
I N F O R M A T I O N S E C U R I T Y > (Date) CODEN: NSPUE2

(Date) CODEN: NSPUE2

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an
experimental procedure or concept adequately. Such identification is not intended to imply recommendation or
materials, or equipment are necessarily the best available for the purpose.
There are references in this publication to documents currently under development by NIST in accordance with
responsibilities assigned to NIST under the Federal Information Security Management Act of 2002. The
methodologies in this document may be used even before the completion of such companion documents. Thus, until
such time as each document is completed, current requirements, guidelines, and procedures (where they exist)
remain operative. For planning and transition purposes, agencies may wish to closely follow the development of
these new documents by NIST. Individuals are also encouraged to review the public draft documents and offer their
comments to NIST. All NIST documents mentioned in this publication, other than the ones noted above, are
available at http://csrc.nist.gov/publications.
COMMENTS MAY BE SUBMITTED TO THE COMPUTER SECURITY DIVISION, INFORMATION TECHNOLOGY
LABORATORY, NIST VIA ELECTRONIC MAIL AT SEC-CERT@NIST.GOV OR VIA REGULAR MAIL AT
100 BUREAU DRIVE (MAIL STOP 8930), GAITHERSBURG, MD 20899-8930
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
EXECUTIVE SUMMARY

EXECUTIVE SUMMARY

Title III of the E-Government Act (Public Law 107-347), titled the Federal Information Security
develop:
• Standards to be used by all Federal agencies to categorize all information and information
systems collected or maintained by or on behalf of each agency based on the objectives
of providing appropriate levels of information security according to a range of risk levels;
• Guidelines recommending the types of information and information systems to be
included in each such category; and
• Minimum information security requirements (i.e., management, operational, and
technical security controls), for information and information systems in each such
category.
In response to the second of these tasks, this guideline has been developed to assist Federal
government agencies to categorize information and information systems. The guideline's
objective is to facilitate application of appropriate levels of information security according to a
range of levels of impact or consequences that might result from the unauthorized disclosure,
modification, or use of the information or information system. This guideline assumes that the
user is familiar with Standards for Security Categorization of Federal Information and
Information Systems (Federal Information Processing Standard [FIPS] 199). The guideline and
its appendices:
• Review the security categorization terms and definitions established by FIPS 199;
• Recommend a security categorization process;
• Describe a methodology for identifying types of Federal information and information
systems;
• Suggest provisional1 security impact levels for common information types;
• Discuss information attributes that may result in variances from the provisional impact
level assignment; and
• Describe how to establish a system security categorization based on the system's use,
connectivity, and aggregate information content.
This document is intended as a reference resource rather than as a tutorial and not all of the
material will be relevant to all agencies. This document includes two volumes, a basic guideline
and a volume of appendices. Users should review the guidelines provided in Volume I, then
refer to only that specific material from the appendices that applies to their own systems and
applications. The provisional impact assignments are provided in Volume II, Appendix C and D.
The basis employed in this guideline for the identification of information types is the Office of
1 Provisional security impact levels are the initial or conditional impact determinations made until all
considerations are fully reviewed, analyzed, and accepted in the subsequent categorization steps by appropriate
officials.
Management and Budget's Federal Enterprise Architecture (FEA) Program Management Office
(PMO) October 2007 publication, The Consolidated Reference Model Document Version 2.3.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.4 Step 4: Assign System Security Category > Extenuating Circumstances

Extenuating Circumstances

This publication focuses on categorizing an information system based on its information types
and associated security objective impacts. There are times when a system security objective
impact level should be elevated based on reasons other than its information. For example, the
information system provides critical process flow or security capability, the visibility of the
system to the public, the sheer number of other systems reliant on its operation or possibly its
overall cost of replacement. These examples, given a specific situation, may provide reason for
the system owner to increase the overall security impact level of a system.
An elevation based on extenuating circumstances can be more apparent by comparing the
original security categorization to the business impact analysis. If the system was categorized
based on FIPS 199 at a Moderate overall impact level but the system owner has determined it
needs to be operational within 4-8 hours of a disruption irrespective of the aggregated
information type availability security impact level assigned, then there is a disconnect that might
be caused by the system's extenuating circumstances. Agencies must customize the information
system availability security impact level as appropriate to obtain full value and accuracy.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Chapter 91. [41 U.S.C., Sec. 403] > [FIPS 200]

Chapter 91. [41 U.S.C., Sec. 403]

Authentication
Verifying the identity of a user, process, or device, often as a
prerequisite to allowing access to resources in an information system.

Authenticity
The property of being genuine and being able to be verified and trusted;
confidence in the validity of a transmission, a message, or message
originator. See authentication.
Authorizing Official
Official with the authority to formally assume responsibility for
operating an information system at an acceptable level of risk to agency
operations (including mission, functions, image, or reputation), agency
assets, or individuals. Synonymous with Accreditation Authority. [FIPS
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > Government Resource Management Information

Government Resource Management Information

The government resource management information business area includes the back office
support activities enabling the Federal government to operate effectively. The five government
resource management information lines of business and the sub-functions associated with each
15 The recommended information types provided in NIST SP 800-60 are established from the "business areas"
and "lines of business" from OMB's Business Reference Model (BRM) section of Federal Enterprise
Architecture (FEA) Consolidated Reference Model Document Version 2.3, October 2007.
information type are identified in Table 6. Volume II, Appendix C.3, "Government Resource
Management Information," recommends provisional impact levels for confidentiality, integrity,
and availability security objectives. Many departments and agencies operate their own support
systems. Others obtain at least some support services from other organizations. Some agencies'
missions are primarily to support other government departments and agencies in the conduct of
direct service missions. As indicated above, security objectives and associated security impact
levels for administrative and management information and systems are determined by the nature
of the supported direct services and constituencies being supported.
Table 6: Government Resource Management Functions and Information Types16
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Chapter 91. [41 U.S.C., Sec. 403] > III]

III]

Information System
Owner (or Program
Manager)
Official responsible for the overall procurement, development,
integration, modification, or operation and maintenance of an
information system. [CNSS Inst. 4009, Adapted]
Information System
Security Officer
Individual assigned responsibility by the senior agency information
security officer, authorizing official, management official, or
information system owner for maintaining the appropriate operational
security posture for an information system or program. [CNSS Inst.
4009, Adapted]
Information
Technology
Any equipment or interconnected system or subsystem of equipment that
is used in the automatic acquisition, storage, manipulation, management,
movement, control, display, switching, interchange, transmission, or
reception of data or information by the executive agency. For purposes
of the preceding sentence, equipment is used by an executive agency if
the equipment is used by the executive agency directly or is used by a
contractor under a contract with the executive agency which: (i) requires
the use of such equipment; or (ii) requires the use, to a significant extent,
of such equipment in the performance of a service or the furnishing of a
product. The term information technology includes computers, ancillary
equipment, software, firmware, and similar procedures, services
(including support services), and related resources. [40 U.S.C., Sec.
1401]
Information Type
A specific category of information (e.g., privacy, medical, proprietary,
financial, investigative, contractor sensitive, security management)
defined by an organization or in some instances, by a specific law,
Executive Order, directive, policy, or regulation. [FIPS 199]
Integrity
Guarding against improper information modification or destruction, and
includes ensuring information non-repudiation and authenticity. [44
U.S.C., Sec. 3542]
Intelligence
(i) the product resulting from the collection, processing, integration,
analysis, evaluation, and interpretation of available information
concerning foreign countries or areas; or
(ii) information and knowledge about an adversary obtained through
observation, investigation, analysis, or understanding. The term
'intelligence' includes foreign intelligence and counterintelligence.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.5 Documenting the Security Categorization Process > Information System Name: SCADA System [and Agency specific identifier]

Information System Name: SCADA System [and Agency specific identifier]

Business and Mission Supported: The SCADA (supervisory control and data acquisition) system provides real-
time control and information supporting the main power plant. The power plant provides critical distribution of
electric power to the military installation.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
INFORMATION SYSTEMS

3.0 SECURITY CATEGORIZATION OF INFORMATION AND

INFORMATION SYSTEMS

Federal Information Processing Standard 199 (FIPS 199), Standards for Security Categorization
of Federal Information and Information Systems, defines the security categories, security
objectives, and impact levels to which SP 800-60 maps information types. FIPS 199 establishes
security categories based on the magnitude of harm expected to result from compromises rather
than on the results of an assessment that includes an attempt to determine the probability of
compromise. FIPS 199 also describes the context of use for this guideline. Some of the content
of FIPS 199 is included in this section in order to simplify the use of this guideline.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.2 Step 2: Select Provisional Impact Level > Integrity Factors

Integrity Factors

Using the FIPS 199 potential impact criteria summarized in Table 7, each information type
should be evaluated for integrity with respect to the impact level associated with unauthorized
modification or destruction of (i) each known variant of the information belonging to the type
and (ii) each use of the information by the system under review. Answers to the following
questions will help in the evaluation process:
• How can a malicious adversary use the unauthorized modification or destruction of
information to do limited/serious/severe harm to agency operations, agency assets, or
individuals?
• Would unauthorized modification/destruction of elements of the information type violate
laws, executive orders, or agency regulations?
Unauthorized modification or destruction of information can take many forms. The changes can
be subtle and hard to detect, or they can occur on a massive scale. One can construct an
extraordinarily wide range of scenarios for modification of information and its likely
consequences. Just a few examples include forging or modifying information to:
• Reduce public confidence in an agency;
• Fraudulently achieve financial gain;
• Create confusion or controversy by promulgating a fraudulent or incorrect procedure;
• Initiate confusion or controversy through false attribution of a fraudulent or false policy;
• Influence personnel decisions;
• Interfere with or manipulate law enforcement or legal processes;
• Influence legislation; or
• Achieve unauthorized access to government information or facilities.
In most cases, the most serious impacts of integrity compromise occur when some action is taken
that is based on the modified information or the modified information is disseminated to other
organizations or the public.
Undetected loss of integrity can be catastrophic for many information types. The consequences
of integrity compromise can be either direct (e.g., modification of a financial entry, medical alert,
or criminal record) or indirect (e.g., facilitation of unauthorized access to sensitive or private
information or deny access to information or information system services). Malicious use of
write access to information and information systems can do enormous harm to an agency's
mission and can be employed to use an agency system as a proxy for attacks on other systems.
In many cases, the consequences of unauthorized modification or destruction of information to
agency mission functions and public confidence in the agency can be expected to be limited. In
other cases, integrity compromises can result in the endangerment of human life or other severe
consequences. The impact can be particularly severe in the case of time-critical information.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.4 Step 4: Assign System Security Category > Large Supporting and Interconnecting Systems

Large Supporting and Interconnecting Systems

Large or complex information systems composed of multiple lower level systems often require
additional consideration regarding assignment of system security categorization. This section
will provide guidelines for applying and interrelating individual system security categorization
results to enterprise organizations, large supporting infrastructures (such as general support
systems, data warehouse applications, large data storage units, server farms, and information
repositories), and interconnecting systems.
Upon security categorization identification for all information systems interacting with large
infrastructure systems, senior IT and security officials have possession of valuable information
that can now enable an enterprise wide security perspective. One significant activity includes
levying an overall security categorization for the agency's supporting network infrastructures.
Since networks, as well as other general support systems, do not inherently "own" mission-based
or management and support information types, the infrastructure's categorization is based on the
aggregation of the information systems' security categorizations. In other words, the
infrastructure's security categorization is the high water mark of the supported information
systems and is based on the information types processed, flowed, or stored on the network or
general support system. Together, the top down enterprise wide threat assessment and bottom up
security assessment derived by aggregation will allow an organization to look at its risk profile
from a comprehensive and balanced view. Further, this analysis will ensure the proper
application of common security controls supporting the multiple information systems and the
protection provided by those controls are inherited by the individual systems.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.4 Step 4: Assign System Security Category > Privacy Information

Privacy Information

The E-Government Act of 2002 complements privacy protection requirements of the Privacy Act
of 1974. Under the terms of these public laws, Federal government agencies have specific
responsibilities regarding collection, dissemination or disclosure of information regarding
individuals.19
The September 26, 2003 OMB Memorandum M-03-22, "OMB Guidance for Implementing the
Privacy Provisions of the E-Government Act of 2002," puts the privacy provisions of the E-
Government Act of 2002 into effect. The guidance applies to information that identifies
individuals in a recognizable form, including name, address, telephone number, Social Security
Number, and e-mail addresses. OMB instructed agency heads "to describe how the government
handles information that individuals provide electronically, so that the American public has
assurances that personal information is protected." Under these public laws and executive
policies, it is necessary to broaden the definition of "unauthorized disclosure" to encompass any
access, use, disclosure, or sharing of privacy-protected information among Federal government
agencies when such actions are prohibited by privacy laws and policies. Since most privacy
regulations focus on access, use, disclosure, or sharing of information, privacy considerations are
dealt with in this guideline as special factors affecting the confidentiality impact level. In
establishing confidentiality impact levels for each information type, responsible parties must
consider the consequences of unauthorized disclosure of privacy information (with respect to
violations of Federal policy and/or law).
Agencies are required to conduct Privacy Impact Assessments (PIAs) before developing IT
systems that contain personally identifiable information or before collecting personally
identifiable information electronically. The impact of privacy violations should consider any
adverse effects experienced by individuals or organizations as a result of the loss of PII
confidentiality. Examples of adverse effects experienced by individuals may include blackmail,
identity theft, discrimination, or emotional distress. Examples of adverse effects experienced by
organizations may include administrative burden, financial losses, loss of public reputation and
confidence, and the penalties associated with violation of the relevant statutes and policies.
Categorizations should be reviewed to ensure that the adverse effects of a loss of PII
confidentiality have been adequately factored into impact determinations. The confidentiality
impact level should generally fall into the moderate range.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.4 Step 4: Assign System Security Category > Public Information Integrity

Public Information Integrity

Most Federal agencies maintain web pages that are accessible to the public. The vast majority of
these public web pages permit interaction between the site and the public. In some cases, the site
provides only information. In other cases, forms may be submitted via the website (e.g.,
applications for service or job applications). In some cases, the site is a medium for business
transactions. Unauthorized modification or destruction of information affecting external
communications (e.g., web pages, electronic mail) may adversely affect operations and/or public
confidence in the agency. In most cases, the damage can be corrected within a relatively short
period of time, and the damage is limited (impact level is low). In other cases (e.g., very large
fraudulent transactions or modification of a web page belonging to an intelligence/security
community component), the damage to mission function and/or public confidence in the agency
can be serious. In such cases, the integrity impact associated with unauthorized modification or
destruction of a public web page would be at least moderate.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
I N F O R M A T I O N S E C U R I T Y > Reports on Computer Systems Technology

NIST Special Publication 800-60 Volume I
Revision 1

I N F O R M A T I O N S E C U R I T Y

Computer Security Division
Information Technology Laboratory
Gaithersburg, MD 20899-8930

August 2008

Carlos M. Gutierrez, Secretary
NATIONAL INSTITUTE OF STANDARDS AND
TECHNOLOGY
James M. Turner, Deputy Director

Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and
Technology (NIST) promotes the U.S. economy and public welfare by providing technical
leadership for the nation's measurement and standards infrastructure. ITL develops tests, test
methods, reference data, proof-of-concept implementations, and technical analyses to advance
the development and productive use of information technology. ITL's responsibilities include the
development of management, administrative, technical, and physical standards and guidelines for
the cost-effective security and privacy of other than national security-related information in
federal information systems. This Special Publication 800-series reports on ITL's research,
guidelines, and outreach efforts in information system security and its collaborative activities
with industry, government, and academic organizations.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > Services Delivery Support Information

Services Delivery Support Information

Most information systems employed in both service delivery support and resource management
activities engage in one or more of the eight support delivery of services lines of business. Each
of the information types associated with support delivery of services sub-functions is provided in
Table 5. Volume II, Appendix C.2, "Services Delivery Support Functions," recommends
provisional impact levels for confidentiality, integrity, and availability security objectives. These
service support functions are the day-to-day activities necessary to provide the critical policy,
programmatic, and managerial foundation that support Federal government operations. The
direct service missions and constituencies ultimately being supported by service support
functions comprise a significant factor in determining the security impacts associated with
compromise of information associated with the support delivery of services business area.
Table 5: Services Delivery Support Functions and Information Types15