Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.3 Human Resource Management > C.3.3.1 HR Strategy Information Type

C.3.3 Human Resource Management

Human resource management activities involve all activities associated with the recruitment
and management of personnel.

C.3.3.1 HR Strategy Information Type

HR Strategy develops effective human capital management strategies to ensure federal
organizations are able to recruit, select, develop, train, and manage a high-quality, productive
workforce in accordance with merit system principles. This sub-function includes: conducting
both internal and external environmental scans; developing human resources and human capital
strategies and plans; establishing human resources policy and practices; managing current and
future workforce competencies; developing workforce plans; developing succession plans;
managing the human resources budget; providing human resources and human capital
consultative support; and measuring and improving human resources performance. The
recommended provisional security categorization for HR strategy information is as follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of HR strategy
information on the ability of responsible agencies to develop effective human capital
management strategies to ensure federal organizations are able to recruit, select, develop, train,
and manage a high-quality, productive workforce in accordance with merit system principles,
and will have only a limited adverse effect on agency operations, assets, or individuals. The
consequences of unauthorized disclosure of the majority of HR strategy information will result in
a limited adverse effect on agency operations, agency assets, or individuals.
Special Factors Affecting Confidentiality Impact Determination: Where more sensitive information is
involved, it will probably be personal information subject to the Privacy Act of 1974, the Health
Insurance Portability and Accountability Act of 1996, or other laws and executive orders
affecting the dissemination of information regarding individuals. In such cases, the consequences
of unauthorized disclosure of HR strategy information could be serious. In such cases, the
confidentiality impact level might be moderate. In a few cases (e.g., where some employees are
potential targets for retaliation by criminal elements or targets of foreign intelligence
organizations), unauthorized disclosure of some HR strategy information (e.g., succession plans,
names, addresses, title, organization, dependents' information) can have life-threatening
consequences and has a high confidentiality impact level.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for disclosure of HR strategy information is low.
not on the time required to detect the modification or destruction of information. The
consequences of unauthorized modification or destruction of HR strategy information depends
mostly on the criticality of the information with respect to agency mission, protection of agency
assets, and safety of individuals. Although there can be serious short-term effects for individuals,
the effects of modifications or deletion of this information are generally limited with respect to
agency mission capabilities or assets.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for HR
strategy information is low.
mission, not on the time required to re-establish access to HR strategy information. HR strategy
processes are generally tolerant of delay. Typically, disruption of access HR strategy
information can be expected to have only a limited adverse effect on agency operations, agency
assets, or individuals.
Recommended Availability Impact Level: The provisional availability impact level recommended for
HR strategy information is low.