Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.2 Financial Management > C.3.2.5 Payments Information Type

C.3.2.5 Payments Information Type

Payments include disbursements of Federal funds, via a variety of mechanisms, to Federal and
private individuals, Federal agencies, state, local and international Governments, and the private
sector, to effect payment for goods and services, or distribute entitlements, benefits, grants,
subsidies, loans, or claims. Payment management provides appropriate control over all
payments made by or on behalf of an organization, including but not limited to payments made
to: vendors in accordance with contracts, purchase orders and other obligating documents; state
governments under a variety of programs; employees for salaries and expense reimbursements;
other Federal agencies for reimbursable work performed; individual citizens receiving Federal
benefits; and recipients of Federal loans. The recommended security categorization for the
payments information type is as follows:
Security Category = {(confidentiality, Low), (integrity, Moderate), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of payments information
on the ability of responsible agencies to provide appropriate control over all payments made by
or on behalf of an organization. In most cases, unauthorized disclosure of payments information
will have only a limited adverse effect on agency operations, assets, or individuals.
Special Factors Affecting Confidentiality Impact Determination: Payment information typically
includes information needed for electronic payments such as bank account numbers.
Unauthorized access to this type of information could result in significant financial loss for both
the Federal government and its payees. Where payment activities are part of an agency's service
delivery mission (e.g., payment of benefits), Privacy Act information and other information
subject to statutory or regulatory dissemination controls must appear in the payment vehicles
(e.g., name and social security number on check records). (The provisional impact levels for
personnel information are documented in the Personal Identity and Authentication, Income,
Representative Payee, and Entitlement Event information types.) In such cases, the
confidentiality impact level can be at least moderate. (See C.2.8.8.)
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for payments information is low.
not on the time required to detect the modification or destruction of information. Payments
activities are not generally time-critical. An accumulation of small changes to data or deletion of
small entries can result in cost overruns and other cases of excessive disbursements. In most
cases, the adverse effects of consequent negative publicity and institution of corrective action
programs on mission functions or public confidence in the agency can be serious.
Special Factors Affecting Integrity Impact Determination: Where payment activities are part of an
agency's service delivery mission (e.g., payment of benefits), the consequences of integrity
compromises that result in failure of payments to go to the appropriate entity can range from
minor to life-threatening. In such cases, the availability impact level can be high. (See C.2.8.11.)
Recommended Integrity Impact Level: For most Federal government payment systems, the
provisional integrity impact level recommended for payments information is moderate.
mission, not on the time required to re-establish access to the payments information. Payment
processes are generally tolerant of delay. Typically, disruption of access to payments information
can be expected to have only a limited adverse effect on agency operations, agency assets, or
individuals.
Special Factors Affecting Availability Impact Determination: Where payment activities are part of an
agency's service delivery mission (e.g., payment of benefits), the consequences of loss of
information availability that result in failure of payments to go to the appropriate entity can range
from minor to life-threatening. In such cases, the availability impact level can be moderate or
high. (See C.2.8.11.)
Recommended Availability Impact Level: For most Federal government payment systems, the
provisional availability impact level recommended for payments information is low.