Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.5 Documenting the Security Categorization Process > Information Types

Information Types

[D.7.1] Energy
Supply
Sensor data monitoring the availability of energy for the Military installation and its soldiers
and command authority. This function includes control of distribution and transfer of power.
The SCADA remote control capabilities can take action such as initiating necessary switching
actions to alleviate an overloading power condition. The impacts to this information and the
SCADA system may affect the installation's critical infrastructures.
[C.2.8.12]General
Information
The SCADA information system processes routine administrative information.
Step 1
Step 2 [Provisional] / Step 3a [Adjustments]
Confidentiality Impact
Integrity Impact
Availability Impact
Identify
Information
Types
Step 3b- Impact Adjustment Justification
L / M
L / H
L / H
Energy Supply
Disclosure of sensor
information may seriously
impact the missions if
indications & warnings of
overall capability are
provided to an adversary.
Severe impacts or
consequences may occur if
adversarial modification of
information results in
incorrect power system
regulation or control actions.
Due to loss of availability,
severe impact to the mission
capability may result and
may in-turn have overall
catastrophic consequences
for the facility's critical
infrastructures and possible
loss of human life.
General
Information
No adjustments
No adjustments
No adjustments
Moderate
High
High
Step 4 System
Categorization:
Overall Information System Impact: High
Figure 3: Security Categorization Information Collection
In addition, agencies may consider enhancing their SSPs with other analyses, decisions,
assignments, and or approvals that were used in the categorization process. Examples may
include:
• Agency's business and mission areas (Step 1 in Table 1)
• Legislative and executive information mandates affecting the information impact
assignment or adjustment (Section 4.1.3)
• Indicating whether the information is time-critical in rationales for assigning availability
impact levels (Section 4.2.2.3)
• Rationales for assigning information to the General Information Type (Section 4.1.2,
Implementation Tip)
• Results of reviews of the appropriateness of the provisional impact levels for information
(Section 4.3)
• Results of considering the potential impacts to other organizations and considering, "in
accordance with the USA Patriot Act of 2001 and Homeland Security Presidential
Directives, potential national-level impacts in categorizing the information system"
(NIST SP 800-53 security control RA-2)
• Results of reviewing the identified security categorizations for the aggregate of
information types (Step 4 in Table 1)
• Effects of various factors and circumstances (e.g., data aggregation, critical system
functionality, privacy, trade secrets, critical infrastructure, aggregation, critical system
functionality, extenuating circumstances) on the system category (Section 4.4.2)
• Whether and why the agency determined that the system impact level must be higher than
any of the levels of the information types that the system processes (Section 4.4)
• Approvals of all determinations or decisions (Step 4 in Table 1)