Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.8 General Government > C.2.8.8 Income Information Information Type

C.2.8.8 Income Information Information Type

Income information includes all the wages, self-employment earnings, savings data and other
financial resources information that is needed to help determine the amount of Retirement,
Survivor, or Disability benefits that individuals may be entitled to receive or not receive from the
Supplementary Security Income or RSDI Title II Programs. In most cases, the impact levels are
based on the effects of unauthorized disclosure, modification, or loss of availability of income
information on the ability of the Federal government to identify citizen entitlements and
obligations and to protect individuals against identity theft and the Federal government against
fraud. The recommended security categorization for the income information type is as follows:
Security Category = {(confidentiality, Moderate), (integrity, Moderate), (availability, Moderate)}
The confidentiality impact level is based on the effects of unauthorized disclosure of income
information on the ability of the Federal government to identify citizen entitlements and
obligations and to protect individuals against identity theft and the Federal government against
fraud. Unauthorized disclosure of raw data and other source information for benefits
determination and revenue collection operations is likely to violate the Privacy Act of 1974 and
other regulations applicable to the dissemination of personal and government information.
Unauthorized disclosure of centrally managed income information can have a serious adverse
effect on agency missions. Therefore, for agencies that manage large income information
involving records of the general public, the provisional confidentiality impact level can be
expected to be at least moderate.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for income information is moderate.
The integrity impact level is based on the specific purpose to which income information is put;
and not on the time required to detect the modification or destruction of information. In the case
of very large data bases containing income information relating to the general public, there is a
significant probability that erroneous actions will be taken affecting the benefits entitlements or
liabilities (e.g., tax liabilities) of large numbers of individuals. This can result in at least short-
term financial hardship for citizens. It can also be expected to result in very serious disruption of
the agency operations due to large time and resource requirements for taking corrective actions.
In such cases, the integrity impact level would be at least moderate.
Special Factors Affecting Integrity Impact Determination: In the case of smaller organizations, and
where the information affected is limited to employees, the consequences may justify only a low
provisional impact rating.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
income information is moderate.
The availability impact level is based on the specific purpose to which income information is
put; and not on the time required to re-establish access to the income information. Benefits
determination and liability calculation (e.g., taxation) processes are generally tolerant of
reasonable delays. In many cases, disruption of access to income information can be expected to
have only a limited adverse effect on agency operations, agency assets, or individuals.
Special Factors Affecting Availability Impact Determination: In the case of very large data bases
containing income information relating to the general public, there is a significant probability
that processing delays will affect the benefits entitlements or liabilities (e.g., tax liabilities) of
large numbers of individuals. The larger the number of records affected, the longer the delays
that can be expected to result. This can result in financial hardship for citizens and in serious
disruption of the agency operations due to large time and resource requirements for backlog
processing. In such cases, the availability impact level would be at least moderate. In the case
of permanent loss of records, the impact might even be high.
Recommended Availability Impact Level: The provisional availability impact level recommended for
income information is moderate.