ezesecops/rmf-ato-core huggingface dataset:
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.5 Information and Technology Management > C.3.5.5 Information Security Information Type

C.3.5.5 Information Security Information Type

IT Security involves all functions pertaining to the securing of Federal data and systems through
the creation and definition of security policies, procedures and controls covering such services as
identification, authentication, and non-repudiation. The recommended security categorization
for the IT security information type is as follows:
Security Category = {(confidentiality, Low), (integrity, Moderate), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of IT security
information on the ability of responsible agencies to secure Federal data and systems through the
creation and definition of security policies, procedures and controls covering such services as
identification, authentication, and non-repudiation. In most cases, the security policy,
procedures, and available controls are not particularly sensitive. Typically, the security
information is used in initializing and implementing the controls (e.g., passwords, cryptographic
keys) that need to be protected. In general, disclosure of the security policies, procedures, and
controls will result in only limited adverse effects on the confidentiality of system information
and processes.
Recommended Confidentiality Impact Level: The recommended provisional confidentiality impact
level recommended for IT security information is low.
not on the time required to detect the modification or destruction of information.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for IT
security information is moderate.
mission, not on the time required to re-establish access to IT security information. Temporary
disruption of access to IT security information can usually be expected to have a limited
adverse effect on agency operations (including mission functions and public confidence in
the agency), agency assets, or individuals.
Recommended Availability Impact Level: The provisional availability impact level recommended for
IT security information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.1

D.1 Defense and National Security Defense and national security operations protect and advance U.S. National Security interests and, if deterrence fails, decisively defeat threats to those interests. Defense and national security activities include military operations, border protection, and intelligence gathering. Defense operations are subdivided into the following sub-elements: • Strategic National and Theater Defense - Establishing national and multinational military objectives, sequencing initiatives, defining limits and assessing risks for the use of military and other instruments of national power, developing global plans or theater war plans to achieve these objectives, and providing military forces and other capabilities in accordance with strategic plans; 28 As mode of delivery of mission-based services, the security categorization of Direct Services to Citizens sub- functions Military Operations and Civilian Operation is dependent on the mission services delivered to the citizens [e.g., Health Care; Emergency Response, Environmental Remediation] should be categorized in accordance with the mission-based information type. • Operational Defense - Linking tactics and strategy by establishing operational objectives needed to accomplish the strategic objectives, sequencing events to achieve the operational objectives, initiating actions, and applying resources to bring about and sustain these events; and • Tactical Defense - The ordered arrangement and maneuver of combat elements in relation to each other and to the enemy to achieve combat objectives. Impacts to information and many information systems associated with defense and national security missions may affect the security of a broad range of critical infrastructures and key national assets. Systems that, involve command and control of military forces, weapons control29, involve equipment that is an integral part of a weapon or weapons system, are critical to the direct fulfillment of military missions or are otherwise employed in strictly military operations30 are defined under Public Law as national security systems. National security information and national security systems are outside the scope of this guideline. Information assurance responsibilities are delegated to the Department of Defense for systems that are operated by the Department of Defense, or another entity on behalf of the Department of Defense31. Security objectives and impact levels associated with these systems are determined by the Department of Defense.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.10

D.10 Community and Social Services Community and Social Services includes all activities aimed at creating, expanding, or improving community and social development, social relationships, and social services in the United States. This includes all activities aimed at locality-specific or nationwide social development and general social services and general community development and social services programs, as well as earned and unearned benefit programs that promote these objectives.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.10 Community and Social Services > D.10.1

D.10.1 Homeownership Promotion Information Type Homeownership Promotion includes activities devoted to assisting citizens interested in buying homes and educating the public as to the benefits of homeownership. Note: Activities devoted to the provision of housing to low-income members of the public are covered under the Housing Assistance mission. The recommended provisional categorization of the homeownership promotion information type follows: Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)} The confidentiality impact level is the effect of unauthorized disclosure of homeownership promotion information on the ability of responsible agencies to assist citizens interested in buying homes and educating the public as to the benefits of homeownership. The consequences of unauthorized disclosure of most homeownership promotion information would have a limited adverse effect on agency operations, agency assets, or individuals. Special Factors Affecting Confidentiality Impact Determination: Exceptions that might have a potential for more serious consequences are based on privacy information processed in training and employment systems (e.g., information required by the Privacy Act of 1974 or other statutes and executive orders to receive special handling to protect the privacy of individuals). The Privacy Act Information provisional impact levels are documented in the Personal Identity and Authentication information type. This can result in assignment of a moderate impact level to such information. Recommended Confidentiality Impact Level: The provisional confidentiality impact level recommended for homeownership promotion information is low. not on the time required to detect the modification or destruction of information. The consequences of unauthorized modification or destruction of homeownership promotion information would have, at most, a limited adverse effect on agency operations, agency assets, or individuals. Unauthorized modification or destruction of information affecting external communications (e.g., web pages, electronic mail) may adversely affect operations and/or public confidence in the agency, but the damage to the mission would usually be limited Recommended Integrity Impact Level: The provisional integrity impact level recommended most homeownership promotion information is low. mission, not on the time required to re-establish access to homeownership promotion information. The effects of disruption of access to most homeownership promotion information or information systems would have a limited adverse effect on agency operations, agency assets, or individuals. Recommended Integrity Impact Level: The provisional availability impact level recommended for homeownership promotion information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.11

D.11 Transportation Transportation involves all federally supported activities related to the safe passage, conveyance, or transportation of goods and/or people. Note that impacts to some information and many information systems associated with transportation activities may affect the security of, not only the transportation infrastructure, but also to a broad range of other critical infrastructures and key national assets.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.12

D.12 Education Education refers to those activities that impart knowledge or understanding of a particular subject to the public. Education can take place at a formal school, college, university or other training program. This mission area includes all government programs that promote the education of the public, including both earned and unearned benefit programs.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.12 Education > D.12.1

D.12.1 Elementary, Secondary, and Vocational Education Information Type Elementary, secondary, and vocational education refers to the provision of education in elementary subjects (reading and writing and arithmetic); education provided by a high school or college preparatory school; and vocational and technical education and training. The recommended provisional categorization of the elementary, secondary, and vocational education information type follows: Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)} The confidentiality impact level is the effect of unauthorized disclosure of elementary, secondary, and vocational education information on the ability of responsible agencies to provide guidance and consultative services. The consequences of unauthorized disclosure of most elementary, secondary, and vocational education information would have a limited adverse effect on agency operations, agency assets, or individuals. Recommended Confidentiality Impact Level: The provisional confidentiality impact level recommended for elementary, secondary, and vocational education information is low. not on the time required to detect the modification or destruction of information. The consequences of unauthorized modification or destruction of elementary, secondary, and vocational education information would have a limited adverse effect on agency operations, agency assets, or individuals. Unauthorized modification or destruction of information affecting external communications (e.g., web pages, electronic mail) may adversely affect operations and/or public confidence in the agency, but the damage to the mission would usually be limited. Recommended Integrity Impact Level: The provisional integrity impact level recommended for elementary, secondary, and vocational education information is low. The effects of disruption of access to most elementary, secondary, and vocational education information or information systems would have a limited adverse effect on agency operations, agency assets, or individuals. Recommended Availability Impact Level: The provisional availability impact level recommended for elementary, secondary, and vocational education information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.12 Education > D.12.4

D.12.4 Cultural and Historic Exhibition Information Type Cultural and Historic Exhibition includes all activities undertaken by the U.S. government to promote education through the exhibition of cultural, historical, and other information, archives, art, etc. The recommended provisional categorization of the cultural and historic exhibition information type follows: Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)} The confidentiality impact level is the effect of unauthorized disclosure of cultural and historic exhibition information on the ability of responsible agencies to promote education through the exhibition of cultural, historical, and other information, archives, art, etc. The consequences of unauthorized disclosure of most cultural and historic exhibition information would have a limited adverse effect on agency operations, agency assets, or individuals. Special Factors Affecting Confidentiality Impact Determination: In cases where disclosure of information might be useful to an individual or organization intent on destruction of historical materials or archives, the potential consequences to key national assets could be serious to severe. Consequently, the confidentiality impact could be moderate to high. Recommended Confidentiality Impact Level: The provisional confidentiality impact level recommended for cultural and historic exhibition information is low. not on the time required to detect the modification or destruction of information. The consequences of unauthorized modification or destruction of cultural and historic exhibition information would have, at most, a limited adverse effect on agency operations, agency assets, or individuals. Unauthorized modification or destruction of information affecting external communications (e.g., web pages, electronic mail) may adversely affect operations and/or public confidence in the agency, but the damage to the mission would usually be limited. Special Factors Affecting Integrity Impact Determination: In cases where undetected modification of information might be useful to an individual or organization intent on the destruction of historical materials or archives, the potential consequences to key national assets could be serious to severe. Consequently, the integrity impact could be moderate to high. Recommended Integrity Impact Level: The provisional integrity impact level recommended for cultural and historic exhibition information is low. mission, not on the time required to re-establish access to cultural and historic exhibition information. The effects of disruption of access to most cultural and historic exhibition information or information systems would have a limited adverse effect on agency operations, agency assets, or individuals. Recommended Availability Impact Level: The provisional availability impact level recommended for cultural and historic exhibition information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.13

D.13 Workforce Management Workforce Management includes those activities that promote the welfare and effectiveness of the Nation's workforce by improving their proficiency, working conditions, advancing opportunities for profitable employment, and strengthening free collective bargaining.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.13 Workforce Management > D.13.2

D.13.2 Labor Rights Management Information Type Labor Rights Management refers to those activities undertaken to ensure that employees and employers are aware of and comply with all statutes and regulations concerning labor rights, including those pertaining to wages, benefits, safety and health, whistleblower, and nondiscrimination policies. The recommended provisional categorization of the labor rights management information type follows: Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)} The confidentiality impact level is the effect of unauthorized disclosure of labor rights management information on the ability of responsible agencies to ensure that employees and employers are aware of and comply with all statutes and regulations concerning labor rights, including those pertaining to wages, benefits, safety and health, whistleblower, and nondiscrimination policies. In some cases, premature release of draft labor rights bulletins might adversely affect the effectiveness of agency operations. In general, the consequences of unauthorized disclosure of most labor rights management information would have, a limited adverse effect on agency operations, agency assets, or individuals. Recommended Confidentiality Impact Level: The provisional confidentiality impact level recommended for labor rights management information is low. not on the time required to detect the modification or destruction of information. Unauthorized modification or destruction of information affecting external communications (e.g., web pages, electronic mail) may adversely affect operations and/or public confidence in the agency, but the damage to the mission would usually be limited. The consequences of unauthorized modification or destruction of labor rights management information would have, at most, a limited adverse effect on agency operations, agency assets, or individuals. Recommended Integrity Impact Level: The provisional integrity impact level recommended for labor rights management information is low. mission, not on the time required to re-establish access to labor rights management information. The effects of disruption of access to most labor rights management information or information systems would have a limited adverse effect on agency operations, agency assets, or individuals. Recommended Availability Impact Level: The provisional availability impact level recommended for labor rights management information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.13 Workforce Management > D.13.3

D.13.3 Worker Safety Information Type Worker Safety refers to those activities undertaken to save lives, prevent injuries, and protect the health of America's workers. The recommended provisional categorization of the worker safety information type follows: Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)} The confidentiality impact level is the effect of unauthorized disclosure of worker safety information on the ability of responsible agencies to protect the health and safety of America's workers. In some cases, premature release of draft worker safety bulletins might adversely affect the effectiveness of agency operations. In general, the consequences of unauthorized disclosure of worker safety information would have a limited adverse effect on agency operations, agency assets, or individuals. Recommended Confidentiality Impact Level: The provisional confidentiality impact level recommended for worker safety information is low. not on the time required to detect the modification or destruction of information. The consequences of unauthorized modification or destruction of worker safety information would have, at most, a limited adverse effect on agency operations, agency assets, or individuals. Unauthorized modification or destruction of information affecting external communications (e.g., web pages, electronic mail) may adversely affect operations and/or public confidence in the agency, but the damage to the mission would usually be limited. Recommended Integrity Impact Level: The provisional integrity impact level recommended for worker safety information is low. mission, not on the time required to re-establish access to worker safety information. The effects of disruption of access to most worker safety information or information systems would have a limited adverse effect on agency operations, agency assets, or individuals. Recommended Availability Impact Level: The provisional availability impact level recommended for worker safety information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.14

D.14 Health Public Health involves Federal programs and activities charged with ensuring and providing for the health and well being of the public. This includes the direct provision of health care services and immunizations as well as the monitoring and tracking of public health indicators for the detection of trends and identification of widespread illnesses/diseases. It also includes both earned and unearned health care benefit programs. Note that impacts to some public health information and information systems may affect the security of critical elements of the public health infrastructure.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.14 Health > D.14.3

D.14.3 Health Care Administration Information Type Health Care Administration assures that federal health care resources are expended effectively to ensure quality, safety, and efficiency. This includes managing health care quality, cost, workload, utilization, and fraud/abuse efforts. Security Category = {(confidentiality, Low), (integrity, Moderate), (availability, Low)} The confidentiality impact level is the effect of unauthorized disclosure of Health Care Administration on the ability of responsible agencies to assure that federal health care resources are expended effectively to ensure quality, safety, and efficiency will have only a limited adverse effect on agency operations, assets, or individuals. Special Factors Affecting Confidentiality Impact Determination: Much information associated with public health monitoring involves confidential patient information subject to the Privacy Act and to HIPAA. The Privacy Act Information provisional impact levels are documented in the Personal Identity and Authentication information type. In some cases, unauthorized disclosure of this information such as privacy-protected medical records can have serious consequences for agency operations. In such cases, the confidentiality impact level may be moderate. Recommended Confidentiality Impact Level: The provisional confidentiality impact level recommended for disclosure of Health Care Administration information is low. not on the time required to detect the modification or destruction of information. Unauthorized modification or destruction of information affecting external communications that contain Health Care Administration information (e.g., web pages, electronic mail) may adversely affect operations and public confidence in the agency and also the agency mission. Special Factors Affecting Integrity Impact Determination: Unauthorized modification or destruction of Health Care Administration information can result in inappropriate allocation or deployment of health care services and possible loss of human life. This can result in assignment of a high impact level to such information. Recommended Integrity Impact Level: The provisional integrity impact level recommended for Health Care Administration information is Moderate. mission, not on the time required to re-establish Health Care Administration information. Health Care Administration information is generally tolerant of delay. Typically, disruption of Health Care Administration information can be expected to have only a limited adverse effect on agency operations, agency assets, or individuals. Recommended Availability Impact Level: The provisional availability impact level recommended for Health Care Administration information is low.