Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.3 Human Resource Management > C.3.3.6 Employee Performance Management Information Type

C.3.3.6 Employee Performance Management Information Type

Employee Performance Management designs, develops, and implements a comprehensive
performance management approach to ensure agency employees are demonstrating competencies
required of their work assignments. Design, develop and implement a comprehensive
performance management strategy that enables managers to make distinctions in performance
and links individual performance to agency goal and mission accomplishment. This sub-function
also includes managing employee performance at the individual level and evaluating the overall
effectiveness of the agency's employee development approach. The recommended provisional
security categorization for employee performance management information is as follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of employee
performance management information regarding the agencies ability to design, develop, and
implement a comprehensive performance management approach to ensure agency employees are
demonstrating competencies required of their work assignments. In most cases, unauthorized
disclosure of employee performance management information will have only a limited adverse
effect on agency operations, assets, or individuals.
Special Factors Affecting Confidentiality Impact Determination: Where more sensitive information is
involved, it will probably be personal information subject to the Privacy Act of 1974. The
Privacy Act Information provisional impact levels are documented in the Personal Identity and
Authentication information type. This can result in assignment of a moderate impact level to
such information.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for disclosure of employee performance management information is low.
not on the time required to detect the modification or destruction of information. The
consequences of unauthorized modification or destruction of employee performance
management information depends mostly on the criticality of the information with respect to
agency mission capability, protection of agency assets, and safety of individuals. Although there
can be serious short-term effects for individuals, the effects of modifications or deletion of this
information are generally limited with respect to agency mission capabilities or assets.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
employee performance management information is low.
mission, not on the time required to re-establish access to employee performance management
information. Employee performance management processes are generally tolerant of delay.
Typically, disruption employee performance management information can be expected to have
only a limited adverse effect on agency operations, agency assets, or individuals.
Recommended Availability Impact Level: The provisional availability impact level recommended
employee performance management information is low.