Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > 4.6 Uses of Categorization Information

4.6 Uses of Categorization Information

The results of system security categorization can and should be used by, or made available to,
appropriate agency personnel to support agency activities including:
• Business Impact Analysis (BIA): Agency personnel should consider the cross-utilization
of security categorization and BIA information in the performance of each activity. Their
common objectives enable agencies to mutually draw from them, thus, providing checks
and balances to ensure accuracy for each information system. Conflicting information
and anomalous conditions, such as a low availability impact and a BIA three-hour
recovery time objective, should trigger a reevaluation by the mission and data owners.
• Capital Planning and Investment Control (CPIC) and Enterprise Architecture (EA): Just
as no IT investment should be made without a business-approved architecture,21 the
security categorization that begins the security life cycle is a business-enabling activity
directly feeding the enterprise architecture and CPIC processes for new investments, as
well as migration and upgrade decisions. Specifically, the security categorization can
provide a firm basis for justifying certain capital expenditures and also can provide
analytical input to avoid unnecessary investments.
• System Design: Understanding and designing the system architecture with varying
information sensitivity levels in mind may assist in achieving economies of scale with
security services and protection through common security zones within the enterprise.
For example, an information system containing privacy information may be located in
one security zone with other information systems containing similar sensitive
information. Each zone may have varying levels of security. For instance, the more
critical zones may require 3-factor authentication where the open area may only require
normal access controls. This type of approach requires a solid understanding of an
agency's information and data types gained through the security categorization process.
21 FEA Consolidated Reference Model Document Version 2.3, October 2007
• Contingency and Disaster Recovery Planning: Contingency and disaster recovery
planning personnel should review information systems that have multiple data types of
varying impact levels and consider grouping applications with similar information system
impact levels with sufficiently protected infrastructures. This ensures efficient application
of the correct contingency and disaster protection security controls and avoids the over
protection of lower impact information systems.
• Information Sharing and System Interconnection Agreements: Agency personnel should
utilize aggregated and individual security categorization information when assessing
interagency connections. For example, knowing that information processed on a high
impact information system is flowing to another agency's moderate impact information
system should cause both agencies to evaluate the security categorization information, the
implemented or resulting security controls, and the risk associated with interconnecting
systems. The results of this evaluation may substantiate the need for additional security
controls in the form of a Service Level Agreement, information systems upgrades,
additional mitigating security controls, or alternative means of sharing the required
information.