ezesecops/rmf-ato-core huggingface dataset:
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.4 Step 4: Assign System Security Category > Trade Secrets

Trade Secrets

There are several laws that specifically prohibit unauthorized disclosure of trade secrets (e.g., 7
U.S.C., Chapter 6, Subchapter II, Section 136h and 42 U.S.C., Chapter 6A, Subchapter XII, Part
E, Section 300j-4(d)(1)). Systems that store, communicate, or process trade secrets will
generally be assigned at least a moderate confidentiality impact level.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
2007 specifies Information Sharing as relating to any method or function, for a given business

C.3.5.9 Information Sharing Information Type

The BRM provided in the FEA Consolidated Reference Model Document, Version 2.3, October

2007 specifies Information Sharing as relating to any method or function, for a given business

area, facilitating: data being received in a usable medium by one or more departments or
agencies as provided by a separate department or agency or other entity; and data being
provided, disseminated or otherwise made available or accessible by one department or agency
for use by one or more separate departments or agencies, or other entities, as appropriate.
Since Information Sharing, as a function, is receiving and disseminating data [other information
types] from business areas already identified, this BRM information type will not require its own
impact assessment. Therefore, agency personnel should identify the information sharing
information type as a pure resource management support activity for the evaluated information
system. With the information sharing information type identified, agency personnel can track
the flow of information to interfacing systems. The recommended security categorization for the
information sharing information type is as follows:
Security Category = {(confidentiality, N/A), (integrity, N/A), (availability, N/A)}
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Chapter 91. [41 U.S.C., Sec. 403] > A-1

200, NIST SP 800-37]

Ensuring timely and reliable access to and use of information. [44
U.S.C., Sec. 3542]

A-1

Business Areas
"Business areas" separate government operations into high-level
categories relating to the purpose of government, the mechanisms the
government uses to achieve its purposes, the support functions necessary
to conduct government operations, and resource management functions
that support all areas of the government's business. "Business areas" are
subdivided into "areas of operation" or "lines of business." The
recommended information types provided in NIST SP 800-60 are
established from the "business areas" and "lines of business" from
OMB's Business Reference Model (BRM) section of Federal Enterprise
Architecture (FEA) Consolidated Reference Model Document Version
2.3
Certification
A comprehensive assessment of the management, operational, and
technical security controls in an information system, made in support of
security accreditation, to determine the extent to which the controls are
implemented correctly, operating as intended, and producing the desired
outcome with respect to meeting the security requirements for the
system. [FIPS 200, NIST SP 800-37]
Chief Information
Officer
Agency official responsible for:
(i) Providing advice and other assistance to the head of the executive
agency and other senior management personnel of the agency to ensure
that information technology is acquired and information resources are
managed in a manner that is consistent with laws, Executive Orders,
directives, policies, regulations, and priorities established by the head of
the agency;
(ii) Developing, maintaining, and facilitating the implementation of a
sound and integrated information technology architecture for the agency;
and
(iii) Promoting the effective and efficient design and operation of all
major information resources management processes for the agency,
including improvements to work processes of the agency. [PL 104-106,
Sec. 5125(b)]
Classified
Information
Information that has been determined pursuant to E.O. 13292 or any
predecessor order to require protection against unauthorized disclosure
and is marked to indicate its classified status when in documentary form.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Chapter 91. [41 U.S.C., Sec. 403] > A-2

A-2

Command and
Control
The exercise of authority and direction by a properly designated
commander over assigned and attached forces in the accomplishment of
the mission. Command and control functions are performed through an
arrangement of personnel, equipment, communications, facilities, and
procedures employed by a commander in planning, directing,
coordinating, and controlling forces and operations in the
accomplishment of the mission.
Preserving authorized restrictions on information access and disclosure,
including means for protecting personal privacy and proprietary
information. [44 U.S.C., Sec. 3542]
Counterintelligence
Information gathered and activities conducted to protect against
espionage, other intelligence activities, sabotage, or assassinations
conducted by or on behalf of foreign governments or elements thereof,
foreign organizations, or foreign persons, or international terrorist
activities.
Criticality
A measure of the degree to which an organization depends
on the information or information system for the success of a mission or
of a business function.
Cryptologic
Of or pertaining to cryptology.
Cryptology
The science that deals with hidden, disguised, or encrypted
communications. It includes communications security and
communications intelligence.
Executive Agency
An executive department specified in 5 U.S.C., Sec. 101; a military
department specified in 5 U.S.C., Sec.102; an independent establishment
as defined in 5 U.S.C., Sec. 104(1); or a wholly owned government
corporation fully subject to the provisions of 31 U.S.C., Chapter 91. [41
U.S.C., Sec. 403]
Federal Enterprise
Architecture
[FEA Program
Management Office]
A business-based framework for government-wide improvement
developed by the Office of Management and Budget that is intended to
facilitate efforts to transform the federal government to one that is
citizen-centered, results-oriented, and market-based.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Chapter 91. [41 U.S.C., Sec. 403] > A-3

A-3

Federal Information
System
An information system used or operated by an executive agency, by a
contractor of an executive agency, or by another organization on behalf
of an executive agency. [40 U.S.C., Sec. 11331]
General Support
System
An interconnected set of information resources under the same direct
management control that shares common functionality. It normally
includes hardware, software, information, data, applications,
communications, and people. [OMB Circular A-130, Appendix III]
High-Impact System
An information system in which at least one security objective (i.e.,
confidentiality, integrity, or availability) is assigned a FIPS 199 potential
impact value of high. [FIPS 200]
Impact
The magnitude of harm that can be expected to result from the
consequences of unauthorized disclosure of information, unauthorized
modification of information, unauthorized destruction of information, or
loss of information or information system availability.
Independent
Regulatory Agency
The Board of Governors of the Federal Reserve System, the Commodity
Futures Trading Commission, the Consumer Product Safety
Commission, the Federal Communications Commission, the Federal
Deposit Insurance Corporation, the Federal Energy Regulatory
Commission, the Federal Housing Finance Board, the Federal Maritime
Commission, the Federal Trade Commission, the Interstate Commerce
Commission, the Mine Enforcement Safety and Health Review
Commission, the National Labor Relations Board, the Nuclear
Regulatory Commission, the Occupational Safety and Health Review
Commission, the Postal Rate Commission, the Securities and Exchange
Commission, and any other similar agency designated by statute as a
Federal independent regulatory agency or commission.
Individual
A citizen of the United States or an alien lawfully admitted for
permanent residence. Agencies may, consistent with individual practice,
choose to extend the protections of the Privacy Act and E-Government
Act to businesses, sole proprietors, aliens, etc.
Information
An instance of an information type. [FIPS 199]
Information Owner
Official with statutory or operational authority for specified information
and responsibility for establishing the controls for its generation,
collection, processing, dissemination, and disposal. [CNSS Inst. 4009]
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Chapter 91. [41 U.S.C., Sec. 403] > A-4

A-4

Information
Resources
Information and related resources, such as personnel, equipment, funds,
and information technology. [44 U.S.C., Sec. 3502]
Information Security
The protection of information and information systems from
unauthorized access, use, disclosure, disruption, modification, or
destruction in order to provide confidentiality, integrity, and availability.
[44 U.S.C., Sec. 3542]
Information System
A discrete set of information resources organized for the collection,
processing, maintenance, use, sharing, dissemination, or disposition of
information. [44 U.S.C., Sec. 3502; OMB Circular A-130, Appendix
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Chapter 91. [41 U.S.C., Sec. 403] > A-5

A-5

Guarding against improper information modification or destruction, and
includes ensuring information non-repudiation and authenticity. [44
U.S.C., Sec. 3542]
Intelligence
(i) the product resulting from the collection, processing, integration,
analysis, evaluation, and interpretation of available information
concerning foreign countries or areas; or
(ii) information and knowledge about an adversary obtained through
observation, investigation, analysis, or understanding. The term
'intelligence' includes foreign intelligence and counterintelligence.
Intelligence
Activities
The term 'intelligence activities' includes all activities that agencies
within the Intelligence Community are authorized to conduct pursuant to
Executive Order 12333, United States Intelligence Activities.
Intelligence
Community
The term 'intelligence community' refers to the following agencies or
organizations:
(i) The Central Intelligence Agency (CIA);
(ii) The National Security Agency (NSA);
(iii) The Defense Intelligence Agency (DIA);
(iv) The offices within the Department of Defense for the collection of
specialized national foreign intelligence through reconnaissance
programs;
(v) The Bureau of Intelligence and Research of the Department of
State;
(vi) The intelligence elements of the Army, Navy, Air Force, and
Marine Corps, the Federal Bureau of Investigation (FBI), the
Department of the Treasury, and the Department of Energy; and
(vii) The staff elements of the Director of Central Intelligence.
Lines of Business
"Lines of business" or "areas of operation" describe the purpose of
government in functional terms or describe the support functions that the
government must conduct in order to effectively deliver services to
citizens. Lines of business relating to the purpose of government and the
mechanisms the government uses to achieve its purposes tend to be
mission-based. Lines of business relating to support functions and
resource management functions that are necessary to conduct
government operations tend to be common to most agencies. The
recommended information types provided in NIST SP 800-60 are
established from the "business areas" and "lines of business" from
OMB's Business Reference Model (BRM) section of Federal Enterprise
Architecture (FEA) Consolidated Reference Model Document Version
2.3
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Chapter 91. [41 U.S.C., Sec. 403] > A-6

A-6

Low-Impact System
An information system in which all three security objectives (i.e.,
confidentiality, integrity, and availability) are assigned a FIPS 199
potential impact value of low. [FIPS 200]
Mission Critical
Any telecommunications or information system that is defined as a
national security system (FISMA) or processes any information the loss,
misuse, disclosure, or unauthorized access to or modification of, would
have a debilitating impact on the mission of an agency.
Moderate-Impact
System
An information system in which at least one security objective (i.e.,
confidentiality, integrity, or availability) is assigned a FIPS 199 potential
impact value of moderate and no security objective is assigned a FIPS
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
4009 Adapted] > A-7

A-7

Potential Impact
The loss of confidentiality, integrity, or availability could be expected to
have: (i) a limited adverse effect (FIPS 199 low); (ii) a serious adverse
effect (FIPS 199 moderate); or (iii) a severe or catastrophic adverse
effect (FIPS 199 high) on organizational operations, organizational
assets, or individuals. [FIPS 199]
Privacy Impact
Assessment (PIA)
An analysis of how information is handled:
(i)
to ensure handling conforms to applicable legal, regulatory,
and policy requirements regarding privacy;
(ii)
to determine the risks and effects of collecting, maintaining,
and disseminating information in identifiable form in an
electronic information system; and
(iii)
to examine and evaluate protections and alternative processes
for handling information to mitigate potential privacy risks.
[OMB Memorandum 03-22]
Public Information
Any information, regardless of form or format that an agency discloses,
disseminates, or makes available to the public.
Risk
The level of impact on organizational operations (including mission,
functions, image, or reputation), organizational assets, individuals, other
organizations, or the Nation resulting from the operation of an
information system given the potential impact of a threat and the
likelihood of that threat occurring. [FIPS 200, Adapted]
Security Category
The characterization of information or an information system based on
an assessment of the potential impact that a loss of confidentiality,
integrity, or availability of such information or information system
would have on organizational operations, organizational assets,
individuals, other organizations, or the Nation. [FIPS 199, Adapted]
Security Controls
The management, operational, and technical controls (i.e., safeguards or
countermeasures) prescribed for an information system to protect the
confidentiality, integrity, and availability of the system and its
information. [FIPS 199]
Security Objectives
Confidentiality, integrity, and availability.[FIPS 199]
Senior Agency
Information Security
Officer
Official responsible for carrying out the Chief Information Officer
responsibilities under FISMA and serving as the Chief Information
Officer's primary liaison to the agency's authorizing officials,
information system owners, and information system security officers.
[44 U.S.C., Sec. 3544]
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
4009 Adapted] > A-9

A-9

Sensitivity
Used in this guideline to mean a measure of the importance assigned to
information by its owner, for the purpose of denoting its need for
protection.
Sub-functions
Sub-functions are the basic operations employed to provide the system
services within each area of operations or line of business. The
recommended information types provided in NIST SP 800-60 are
established from the "business areas" and "lines of business" from
OMB's Business Reference Model (BRM) section of Federal Enterprise
Architecture (FEA) Consolidated Reference Model Document Version
2.3
System
See Information System.
Telecommunications
The transmission, between or among points specified by the user, of
information of the user's choosing, without change in the form or content
of the information as sent and received.
Threat
Any circumstance or event with the potential to adversely impact agency
operations (including mission, functions, image, or reputation), agency
assets, individuals, other organizations, or the Nation through an
information system via unauthorized access, destruction, disclosure,
modification of information, and/or denial of service. [CNSS Inst. 4009,
Adapted]
Vulnerability
Weakness in an information system, system security procedures, internal
controls, or implementation that could be exploited or triggered by a
threat source. [CNSS Inst. 4009, Adapted]
Weapons System
A combination of one or more weapons with all related equipment,
materials, services, personnel, and means of delivery and deployment (if
applicable) required for self-sufficiency.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX B: REFERENCES

APPENDIX B: REFERENCES

S. 3418 [5 U.S.C. § 552A through Public Law 93-579], 93rd U.S. Cong., 2d Sess., The Privacy
Act of 1974, December 31, 1974 (effective September 27, 1975).
S. 244 [Public Law 104-13], 104th U.S. Cong., 1t Sess., Paperwork Reduction Act of 1995, May
22, 1995.
S. 1124, Division E [Public Law 104-106], 104th U.S. Cong., 2d Sess., Information Technology
Management Reform Act of 1996, February 10, 1996.
H.R. 3162, Titles VII and Title IX [Public Law 107-56], 107th U.S. Cong., 1t Sess., The USA
PATRIOT Act of 2001, October 26, 2001.
Public Law 107-296, Critical Information Infrastructure Act of 2002, §§211-215, November 25,
2002.
H.R. 2458 [Public Law 107-347], 107th U.S. Cong., 2d Sess., E-Government Act of 2002,
December 17, 2002.
H.R. 2458, Title III [Public Law 107-347], 107th U.S. Cong., 2d Sess., Federal Information
Security Management Act of 2002, December 17, 2002.
Executive Office of the President, Presidential Decision Directive 63, Protecting America's
Critical Infrastructures, May 22, 1998.
United States Office of Management and Budget, Circular No. A-130, Appendix III, Transmittal
Memorandum #4, Management of Federal Information Resources, November 2000.
United States Office of Management and Budget, OMB Guidance for Implementing the Privacy
Provisions of the E-Government Act of 2002, September 29, 2003.
United States Office of Management and Budget (OMB), Federal Enterprise Architecture (FEA)
Program Management Office (PMO), FEA Consolidated Reference Model 2.3, October 2007.
Federal Information Processing Standards Publication 199, Standards for Security
Categorization of Federal Information and Information Systems, December 2003.
Federal Information Processing Standards Publication 200, Minimum Security Requirements for
Federal Information and Information Systems, March 2006.
Publication 800-18, Guide for Developing Security Plans for Federal Information Systems,
Revision 1, February 2006.
Publication 800-30, Risk Management Guide for Information Technology Systems, July 2002.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Appendix C.1, “Recommended Provisional Impact Levels for Management and Support

Appendix C.1, "Recommended Provisional Impact Levels for Management and Support

Information Types," documents impact levels for information types identified in Section 4.1.2.
These are provisional levels, subject to review and modification by agency stakeholders.
Provisional impact level assignments are only the first step in impact assignment and are
reviewed in the subsequent risk assessment processes. They are not designed to be used by
auditors as a definitive checklist for information types and impact assignments.
Most information systems employed in both direct services and administrative/management
support activities perform one or more of the service delivery support functions described in
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Appendix C.2, “Rationale and Factors for Services Delivery Support Information.” These

Appendix C.2, "Rationale and Factors for Services Delivery Support Information." These

service support functions are the day-to-day activities necessary to the organizations that provide
services to the general population and administrative/management services to government
departments and agencies responsible for the provision of those services. As in the case of
administrative/business information and information systems, the security objectives and impacts
are determined by the direct service missions and constituencies ultimately being supported. It is
likely that all Federal government information systems store, process, and operate under the
control of information technology (IT) infrastructure maintenance information (e.g., password
files and file and network access settings). At least a basic set of security controls will apply to
this set of information and processes in order to combat potential corruption, misuse, or abuse of
system information and processes.
Information necessary to conduct administrative or business services that support mission
accomplishment includes the government resource management information types described in
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Appendix C.3, “Rationale and Factors for Government Resource Management Information.” All

Appendix C.3, "Rationale and Factors for Government Resource Management Information." All

of the departments and agencies performing direct service functions are supported by
information systems that perform the activities described in Appendix C.3. Many departments
and agencies operate their own support systems. Others obtain at least some support services
from other organizations. Some agencies' missions are primarily to support other government
departments and agencies in the conduct of direct service missions. As indicated above, security
objectives and security impact levels for administrative and management information and
information systems are determined by the natures of the supported direct services and
constituencies being supported.
Much of the discussion of factors affecting assignment of impact level is common to many
information types. Because this guideline is intended as a reference document, and it is
anticipated that most users will refer only to one or a few information types of interest, several
common or similar observations appear with each information type to which they are
appropriate. Some impact factors common to all information types are discussed in Volume I,
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX B: REFERENCES > B-2

B-2

Publication 800-34, Contingency Planning Guide for Information Technology Systems, June
2002.
Publication 800-37, Guide for the Security Certification and Accreditation of Federal
Information Systems, May 2004.
Publication 800-39, Draft Managing Risk from Information Systems: An Organizational
Perspective, April 2008.
Publication 800-53, Recommended Security Controls for Federal Information Systems, Revision
2, December 2007.
Publication 800-53A, Guide for Assessing the Security Controls in Federal Information Systems,
July 2008.
Publication 800-59, Guideline for Identifying an Information System as a National Security
System, August 2003.
Publication 800-64, Security Considerations in the Information System Development Life Cycle,
June 2004.