Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.1 Controls and Oversight > C.2.1.2 Program Evaluation Information Type

C.2.1.2 Program Evaluation Information Type

Program Evaluation involves the analysis of internal and external program effectiveness and the
determination of corrective actions as appropriate. The impact levels should be commensurate
with the impact levels of the program that is being evaluated. For example, if the program
contains very sensitive financial data with moderate impact levels for confidentiality and
integrity, the program evaluation impact levels for confidentiality and integrity should also be
moderate. The recommended security categorization for the program evaluation information type
is as follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of program evaluation
information on the abilities of responsible agencies to analyze internal and external program
effectiveness and to determine appropriate corrective actions. The confidentiality impact of
program evaluation information is largely event-driven. Once the evaluation has been reported,
most program evaluation information is in the public domain. However, premature unauthorized
disclosure of program evaluation information can alert personnel associated with programs under
evaluation to the focus and preliminary findings of investigative and evaluation activities.
Special Factors Affecting Confidentiality Impact Determination: Where a major programs or human
safety is at stake, actions taken based on unauthorized disclosure of program evaluation
information can pose a threat to human life or a loss of major assets. In such cases, the
confidentiality impact is high. Unauthorized disclosure of most program evaluation information
often has the potential to seriously affect agency operations. Also, some program evaluation
information, particularly in the case of current investigations, includes personal information
subject to the Privacy Act of 1974 and/or information that is proprietary to a corporation or other
organization. The Privacy Act Information provisional impact levels are documented in the
Personal Identity and Authentication information type. Additionally, there are legislative
mandates prohibiting unauthorized disclosure of trade secrets. Trade secrets will generally be
assigned a moderate confidentiality impact level. If the program evaluation information is
moved to the public domain, the confidentiality impact level becomes Not Applicable (NA).
Recommended Confidentiality Impact Level: Because there are many cases in which unauthorized
disclosure of program evaluation information will have only a limited adverse effect on agency
operations, assets, or individuals, the provisional confidentiality impact level recommended for
program evaluation information is low.
The consequences of undetected unauthorized modification or destruction of program evaluation
information can compromise the effectiveness of an evaluation program (e.g., by providing false
information intended to mislead investigators or evaluators or to give program personnel a basis
for claiming investigative or evaluative irregularities). The integrity impact level is based on the
specific mission and the data supporting that mission, not on the time required to detect the
modification or destruction of information. Although there are time-sensitive exceptions,
unauthorized modification or destruction of most program evaluation information should have
only a limited adverse effect on agency operations, assets, or individuals.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
program evaluation information is low.
mission, not on the time required to re-establish access to the program evaluation information.
Although there are time-sensitive exceptions, most program evaluation processes are tolerant of
reasonable delays. In most cases, disruption of access to program evaluation information can be
expected to have only a limited adverse effect on agency operations, agency assets, or
individuals.
Recommended Availability Impact Level: The provisional availability impact level recommended for
program evaluation information is low.