Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.3 Planning and Budgeting > C.2.3.7 Management Improvement Information Type

C.2.3.7 Management Improvement Information Type

Management Improvement includes all efforts to gauge the ongoing efficiency of business
processes and identify opportunities for reengineering or restructuring. The recommended
provisional security categorization for the management improvement information type is as
follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of management
improvement information on the ability of responsible agencies to gauge the ongoing efficiency
of business processes and identify opportunities for reengineering or restructuring. Premature
public release of draft plans before internal coordination and review can result in unnecessary
damage to public confidence in the agency. This is particularly likely where the release includes
unedited internal commentary and discussion. However, the consequence of loss of
confidentiality of most management improvement information is likely to involve only limited
harm to government assets, personnel, or missions.
Special Factors Affecting Confidentiality Impact Determination: Unauthorized disclosure of some
background information that supports development of Federal management improvement plans
can reveal personnel-sensitive information, including information subject to the Privacy Act of
1974. The Privacy Act Information provisional impact levels are documented in the Personal
Identity and Authentication information type. Other background information can reveal sensitive
vulnerabilities, capabilities, or methods of anti-terrorism, law enforcement, or national security
activities. Depending on the information in question, the confidentiality impact can be
moderate, high, or involve national security information (outside the scope of this guideline).
Also, some strategic plans are themselves national security information.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for management improvement information is low.
not on the time required to detect the modification or destruction of information.
Special Factors Affecting Integrity Impact Determination: Unauthorized modification or destruction
of information affecting external communications that contain management improvement
information (e.g., web pages, electronic mail) may adversely affect operations or public
confidence in the agency, but the damage to the mission would usually be limited. Public
confidence consequences can be expected to be more serious for agencies that have national
defense, intelligence, or information security missions. In such cases, the impact may be at least
moderate. Failure to detect malicious modification of personnel information (mostly
background information) can result in disruption of some agency operations and disruptive
administrative or legal actions.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
management improvement information is low.
mission, not on the time required to re-establish access to the management improvement
information. The management improvement planning processes are usually tolerant of delays.
Recommended Availability Impact Level: The provisional availability impact level recommended for
management improvement information is low.