Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.5 Information and Technology Management > C.3.5.7 Information Management Information Type

C.3.5.7 Information Management Information Type

Information Management involves the coordination of information collection, storage, and
dissemination, and destruction as well as managing the policies, guidelines, and standards
regarding information management. Subject to exception conditions described below, the
recommended security categorization for the information management information type is as
follows:
Security Category = {(confidentiality, Low), (integrity, Moderate), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of information
management information on the ability of responsible agencies to perform the day-to-day
processes of information collection, storage, dissemination, and destruction and managing the
policies, guidelines, and standards regarding information management. The consequences of
unauthorized disclosure depend largely on the content and use of the information being managed.
The unauthorized disclosure of information management information relevant to most
information managed by the government will have only a limited adverse effect on agency
operations, assets, or individuals.
Special Factors Affecting Confidentiality Impact Determination: Information collection and storage
involve the day-to-day processes of gathering and storing data from agency programs, partners,
and stakeholders. More sensitive information being managed is usually personal information
subject to the Privacy Act of 1974 or information that is proprietary to a corporation or other
organization. The Privacy Act Information provisional impact levels are documented in the
Personal Identity and Authentication information type. Such information will often be assigned
a moderate confidentiality impact level
Where any of the information to be managed can be expected to have a high confidentiality,
impact level, then the information management information must be assigned a high
confidentiality impact level. When the data being managed belongs to one of the information
types described in this guideline, the confidentiality impact assigned to the system is that of the
highest impact information type processed by the system. Depending on the agency and the
mission being supported, the sensitivity of the information can range from none (public
information) to high. (National security information and national security systems are outside
the scope of this guideline.)
Recommended Confidentiality Impact Level: Particularly in the case of passwords and
cryptographic keys, the provisional impact level recommended for information management
information depends on the sensitivity and criticality of system information and processes.
Although an individual organization's IT infrastructure maintenance information type base may
include data elements that will require a higher rating, the recommended provisional impact is
low.
not on the time required to detect the modification or destruction of information. The
consequences of unauthorized modification or destruction of information management
information (e.g., configuration settings, passwords, authorization codes, cryptographic keying
material) can compromise the effectiveness of the system and impair agency operations. The
level of impact depends on the criticality of system functionality to the agency mission
Special Factors Affecting Integrity Impact Determination: The loss of integrity for some information
management information (e.g., encryption keys) can be very serious for agency operations and
can have serious consequences for public confidence in the agency. The integrity impact level
recommended for information management information associated with highly critical
information is high.
Recommended Integrity Impact Level: Potentially serious adverse effects can be expected in most
government organizations resulting from the unauthorized modification or deletion of
information management information. Therefore, the provisional integrity impact level
recommended for information management information is moderate.
mission, not on the time required to re-establish access to information management
information. The effects of disruption of access to information management information may
temporarily impair agency operations. The level of impact depends on the sensitivity of the
information being managed and the criticality of the system to the agency mission. Except for
information needed by real-time processes (e.g., information that feeds real-time monitoring or
audit functions), information management processes are generally tolerant of reasonable
delays. In most cases, disruption of access to information management information can be
expected to have only a limited adverse effect on agency operations, agency assets, or
individuals. Not many business management systems perform functions for which loss of
availability can cause significant degradation in mission capability, place the agency at a
significant disadvantage, result in major damage to assets, or pose a threat to human life.
Recommended Availability Impact Level: The provisional availability impact level recommended for
information management information is low.