Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.1 Administrative Management > C.3.1.1 Facilities, Fleet, and Equipment Management Information Type

C.3.1.1 Facilities, Fleet, and Equipment Management Information Type

Facilities, Fleet, and Equipment management involves the maintenance, administration,
certification, and operation of office buildings, fleets, machinery, and other capital assets
considered as possessions of the Federal government. Impacts to some information and
information systems associated with facilities, fleet, and equipment management may affect the
security of some key national assets (e.g., nuclear power plants, dams, and other government
facilities). The following recommended provisional categorization of the facilities, fleet, and
equipment management information type is particularly subject to change where critical
infrastructure elements or key national assets are involved:
Security Category = {(confidentiality, Low19), (integrity, Low20), (availability, Low20)}
19 Impact level is usually high where safety of major critical infrastructure components or key national assets is at
stake.
The confidentiality impact level is the effect of unauthorized disclosure of facilities, fleet, and
equipment management information on the ability of responsible agencies to maintain,
administer, and operate offices buildings, fleets, machinery, and other capital assets of the
Federal government. The consequences of unauthorized disclosure of most facilities, fleet, and
equipment management information are likely to have only a limited adverse effect on agency
operations, agency assets, or individuals.
Special Factors Affecting Confidentiality Impact Determination: Information associated with
maintenance, administration, and operation of many Federal government office buildings,
transportation fleets, and operational facilities can be of material use to criminals seeking to gain
access to Federal facilities in order to facilitate or perpetrate fraud, theft, or some other criminal
enterprise (e.g., extract inmates from Federal detention facilities). In this case, unauthorized
disclosure of information can have a serious adverse effect on agency operations, agency assets,
or individuals. The consequent confidentiality impact would be at least moderate.
Information associated with maintenance, administration, and operation of other Federal
government office buildings, transportation fleets, and operational facilities can be of material
use to terrorists seeking to penetrate and/or commandeer such facilities as part of operations
intended to harm critical infrastructures, key national assets, or people. Examples of this
information include information that reveals specific measures respecting limiting access to and
operation of government aircraft, maintenance and administrative information that might permit
either covert pedestrian or unimpeded vehicular access to government buildings (e.g.,
Congressional office buildings, FBI Headquarters, the National Archives, Smithsonian
Institution buildings, dams, nuclear power plants, etc.), and schedules/itineraries of government
surface transportation fleets (e.g., for transport of executive personnel or hazardous materials).
In these cases, the confidentiality impact must be considered to be high.
[Some information regarding transportation and storage of nuclear materials is classified as
national security related and is outside the scope of this guideline. Other information, such as
Nuclear Regulatory Commission "SAFEGUARDS" information is not national security
information, but must have a high confidentiality impact level.]
Anticipated or realized unauthorized disclosure of one agency's facilities, fleet, and equipment
management information by another agency could result in negative impacts on cross-
jurisdictional coordination within the facilities, fleet, and equipment management infrastructure
and the general effectiveness of organizations tasked with facilities, fleet, and/or equipment
management.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for facilities, fleet, and equipment management information is low.
not on the time required to detect the modification or destruction of information. In addition, the
20 Impact level is usually moderate to high in emergency situations where time-critical processes affecting human
safety or major assets are involved.
consequences of unauthorized modification to or destruction of facilities, fleet, and equipment
management information may depend on the urgency with which the information is needed or
the immediacy with which the information is used. In most cases, it is unlikely that the
information will be time-critical or acted upon immediately.
Special Factors Affecting Integrity Impact Determination: Exceptions may include emergency
response aspects of disaster management or leadership protection. In such cases, the integrity
impact level associated with unauthorized modification or destruction of facilities, fleet, and
equipment management information can be high.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
facilities, fleet, and equipment management information is low.
mission, not on the time required to re-establish access to the facilities, fleet, and equipment
management information. Functions supported by most facilities, fleet, and equipment
management information are tolerant of delays. Typically, disruption of access to facilities, fleet,
and equipment management information has a limited adverse effect on agency operations
(including mission functions and public confidence in the agency), agency assets, or individuals.
Special Factors Affecting Availability Impact Determination: Exceptions may include emergency
response aspects of disaster management or leadership protection. In such cases, delays
measured in seconds can cost lives and major property damage. Consequently, the availability
impact level associated with unauthorized modification or destruction of facilities, fleet, and
equipment management information needed to respond to emergencies will be high.
Recommended Availability Impact Level: The provisional availability impact level recommended for
facilities, fleet, and equipment management information is low.