Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.2 Regulatory Development > C.2.2.1 Policy and Guidance Development Information Type

C.2.2 Regulatory Development

Regulatory Development involves activities associated with providing input to the
lawmaking process in developing regulations, policies, and guidance to implement laws.

C.2.2.1 Policy and Guidance Development Information Type

Policy and Guidance Development involves the creation and dissemination of guidelines to assist
in the interpretation and implementation of regulations. In most cases, the effect on public
welfare of a loss of policy and guidance development mission capability can be expected to be
delayed rather than immediate. As a result, the potential for consequent loss of human life or of
major national assets is relatively low, since these most catastrophic consequences of impairment
to mission capability can, in most cases, be corrected before they are fully realized. The
recommended security categorization for the policy and guidance development information type
is as follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of policy and guidance
information on the ability of responsible agencies to create and disseminate guidelines to assist in
the interpretation and implementation of regulations. The confidentiality impact of policy and
guidance information is largely event-driven. Once a policy or guidance statement has been
promulgated, most policy and guidance information is in the public domain. However,
premature unauthorized disclosure of candidate policy and guidance material can result in
disruption of (and inappropriate influence of special interests on) the policy development
process.
Special Factors Affecting Confidentiality Impact Determination: The effects of loss of confidentiality
of guidelines during the formative stage can result in attempts by affected entities and other
interested parties to influence and/or impede the policy and guideline development process.
Premature public release of formative policies and guidelines before internal coordination and
review can result in unnecessary damage to public confidence in the agency. This is particularly
likely where the release includes unedited internal commentary and discussion. Delays can
impair an agency's mission, but loss of public confidence can do serious and persistent harm to
an agency's ability to effectively perform its mission. In such cases, the provisional
confidentiality impact level recommended for policy and guidance development information is
moderate. When the policy and guidance information is in the public domain, the confidentiality
impact level becomes Not Applicable (NA).
Recommended Confidentiality Impact Level: Although there are cases in which unauthorized and
premature disclosure of policy and guidance information can result in serious consequences for
an agency, most of this information is intended to be available to the general public.
Consequently, the provisional confidentiality impact level recommended for policy and guidance
development information is low.
not on the time required to detect the modification or destruction of information.
Special Factors Affecting Integrity Impact Determination: Some policy and guidance information is
time-critical. Unauthorized modification or destruction of information affecting external
communications that contain policy and guidance development information (e.g., web pages,
electronic mail) may adversely affect operations or public confidence in the agency, but the
damage to the mission would usually be limited. Public confidence consequences can be
expected to be much more serious in cases of agencies that have national defense, intelligence, or
information security missions. In such cases, the impact may be at least moderate.
Recommended Integrity Impact Level: The provisional integrity level recommended for policy and
guidance development information is low.
mission, not on the time required to re-establish access to the policy and guidance development
information. Though some policy and guidance information is time-critical, the policy and
guidance development process is usually tolerant of delays.
Recommended Availability Impact Level: the provisional availability impact level recommended for
policy and guidance development information is low.