ezesecops/rmf-ato-core huggingface dataset:
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.8 Environmental Management > D.8.3

D.8.3 Pollution Prevention and Control Information Type Pollution prevention and control includes activities associated with the establishment of environmental standards to control the levels of harmful substances emitted into the soil, water and atmosphere. The following security categorization is recommended for the pollution prevention and control information type: Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)} The confidentiality impact level is the effect of unauthorized disclosure of pollution prevention and control information on the abilities of responsible agencies to establish environmental standards to control the levels of harmful substances emitted into the soil, water and atmosphere. Unauthorized disclosure of pollution prevention and control information can result in incomplete information being published as agency standards or policy, misunderstandings that prevent or increase the difficulty of promulgating standards, or the discrediting of valid proposed standards or policies by exposure of partial information out of context. The consequences of such unauthorized disclosures may have an adverse effect on public confidence in the agency, or agency operations and may place the agency at an operational disadvantage. Most unauthorized disclosure of pollution prevention and control information will have only a limited adverse effect on the affected agency. Recommended Confidentiality Impact Level: The provisional confidentiality impact level recommended for pollution prevention and control information is low. not on the time required to detect the modification or destruction of information. The consequences of unauthorized modification or destruction of pollution prevention and control information may depend on the urgency with which the information is typically needed. Unauthorized modification or destruction of information affecting external communications (e.g., web pages, electronic mail) may adversely affect operations, public confidence in the agency, and the agency mission. Recommended Integrity Impact Level: The provisional integrity impact level recommended for pollution prevention and control information is low. mission, not on the time required to re-establish access to pollution prevention and control information. Except for cases of emergency bulletins necessary to correct existing threats to public safety, pollution prevention and control processes are usually tolerant of delays. Recommended Availability Impact Level: The provisional availability impact level recommended for pollution prevention and control information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.9

D.9 Economic Development Economic Development includes the activities required to promote commercial/industrial development and to regulate the American financial industry to protect investors. It also includes the management and control of the domestic economy and the money supply, and the protection of intellectual property and innovation. Note: The promotion of U.S. business overseas is captured in the function, "International Affairs and Commerce."
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.9 Economic Development > D.9.1

D.9.1 Business and Industry Development Information Type Business and industry development supports activities related to the creation of economic and business opportunities and stimulus, and the promotion of financial and economic stability for corporations and citizens involved in different types of business. The recommended provisional categorization of the business and industry development information type follows: Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)} The confidentiality impact level is the effect of unauthorized disclosure of business and industry development information on the ability of responsible agencies to create economic and business opportunities and stimulus, and promote financial and economic stability for corporations and citizens involved in different types of business. The consequences of unauthorized disclosure of most business and industry development information would have, at most, a limited adverse effect on agency operations, agency assets, or individuals. Special Factors Affecting Confidentiality Impact Determination: There may be some cases for which moderate confidentiality impact is associated with unauthorized disclosure of business/industry development. For example, unauthorized disclosure of private information concerning individuals or businesses can result in legal expense and serious effects on public confidence in the agency. Similarly, unauthorized disclosure of details of current agency business and industry development activities and plans can serve to focus opposition and/or give an unfair advantage to competing interests. Additionally, there are legislative mandates prohibiting unauthorized disclosure of trade secrets. Trade secrets will generally be assigned a moderate confidentiality impact level. Recommended Confidentiality Impact Level: The provisional confidentiality impact level recommended for business/industry development information is low. not on the time required to detect the modification or destruction of information. The consequences of unauthorized modification or destruction of business and industry development information may depend on the urgency with which the information is typically needed. Unauthorized modification or destruction of information affecting external communications (e.g., web pages, electronic mail) may adversely affect operations and/or public confidence in the agency, but the damage to the mission would usually be limited. Recommended Integrity Impact Level: The provisional integrity impact level recommended for most business and industry development information is low. mission, not on the time required to re-establish access to business and industry development information. Missions supported by business and industry development information are generally tolerant of delay. Recommended Availability Impact Level: The provisional availability impact level recommended for business and industry development information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.9 Economic Development > D.9.4

D.9.4 Industry Sector Income Stabilization Information Type Industry Sector Income Stabilization involves all programs and activities devoted to assisting adversely impacted industrial sectors (farming, commercial transportation, etc.) to ensure the continued availability of their services for the American public and the long-term economic stability of these sectors. The provisional recommended security categorization for the industry sector income stabilization information type is as follows: Security Category = {(confidentiality, Moderate), (integrity, Low), (availability, Low)} The confidentiality impact level is the effect of unauthorized disclosure of industry sector income stabilization information on the ability of responsible agencies to assist adversely impacted industrial sectors (farming, commercial transportation, etc.) to ensure the continued availability of their services for the American public and the long-term economic stability of these sectors. In most cases, unauthorized disclosure of industry sector income stabilization information will have only a limited adverse effect on agency operations, assets, or individuals. However, unauthorized premature disclosure of Federal government plans for industry sector income stabilization actions (e.g., grants or subsidies) as well as of government economic forecasts and commentary preliminary to formulation of plans may result in major financial consequences. Unauthorized and premature disclosure to a single institution (e.g., a major manufacturing institution, a major agribusiness institution, or a commodity brokerage house), could damage confidence in economic stabilization institutions and have a severe adverse effect on public confidence in the government. Recommended Confidentiality Impact Level: The provisional confidentiality impact level recommended for industry sector income stabilization information is moderate. not on the time required to detect the modification or destruction of information. Industry sector income stabilization activities are not generally time-critical. In most cases, the adverse effects of unauthorized modification or destruction of industry sector income stabilization information on agency mission functions and public confidence in the agency will be limited. Recommended Integrity Impact Level: The provisional integrity impact level recommended for industry sector income stabilization information is low. mission, not on the time required to re-establish access to industry sector income stabilization information. Industry sector income stabilization processes are generally tolerant of delay. In most cases, disruption of access to industry sector income stabilization information can be expected to have only a limited adverse effect on agency operations, agency assets, or individuals. Recommended Availability Impact Level: The provisional availability impact level recommended for industry sector income stabilization information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
EXECUTIVE SUMMARY

EXECUTIVE SUMMARY

Title III of the E-Government Act (Public Law 107-347), titled the Federal Information Security
develop:
• Standards to be used by all Federal agencies to categorize all information and information
systems collected or maintained by or on behalf of each agency based on the objectives
of providing appropriate levels of information security according to a range of risk levels;
• Guidelines recommending the types of information and information systems to be
included in each such category; and
• Minimum information security requirements (i.e., management, operational, and
technical security controls), for information and information systems in each such
category.
In response to the second of these tasks, this guideline has been developed to assist Federal
government agencies to categorize information and information systems. The guideline's
objective is to facilitate provision of appropriate levels of information security according to a
range of levels of impact or consequences that might result from the unauthorized disclosure,
modification, or loss of availability of the information or information system. This guideline
assumes that the user is familiar with Standards for Security Categorization of Federal
Information and Information Systems (FIPS 199). The guideline and its appendices:
• Review the security categorization terms and definitions established by FIPS 199;
• Recommend a security categorization process;
• Describe a methodology for identifying types of Federal information and information
systems;
• Suggest provisional security impact levels for common information types;
• Discuss information attributes that may result in variances from the provisional security
impact level assignment; and
• Describe how to establish a system security categorization based on the system's use,
connectivity, and aggregate information content.
This document is intended as a reference resource rather than as a tutorial. Not all of the
material will be relevant to all agencies. This document includes two volumes, a basic guideline
and a volume of appendices. Users should review the guidelines provided in Volume I, then
refer to only that specific material from the appendices that applies to their own systems and
applications.
The provisional security impact level assignments contained in appendices C and D are only the
first step in impact assignment and subsequent risk assessment processes. The impact
assignments are not intended to be used by auditors as a definitive checklist for information
types and impact assignments.
The basis employed in this guideline for the identification of information types is the Office of
Management and Budget's Federal Enterprise Architecture (FEA) Program Management Office
(PMO) October 2007 publication, The Consolidated Reference Model Document Version 2.3.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Chapter 91. [41 U.S.C., Sec. 403] > III]

III]

Information System
Owner (or Program
Manager)
Official responsible for the overall procurement, development,
integration, modification, or operation and maintenance of an
information system. [CNSS Inst. 4009, Adapted]
Information System
Security Officer
Individual assigned responsibility by the senior agency information
security officer, authorizing official, management official, or
information system owner for maintaining the appropriate operational
security posture for an information system or program. [CNSS Inst.
4009, Adapted]
Information
Technology
Any equipment or interconnected system or subsystem of equipment that
is used in the automatic acquisition, storage, manipulation, management,
movement, control, display, switching, interchange, transmission, or
reception of data or information by the executive agency. For purposes
of the preceding sentence, equipment is used by an executive agency if
the equipment is used by the executive agency directly or is used by a
contractor under a contract with the executive agency which: (i) requires
the use of such equipment; or (ii) requires the use, to a significant extent,
of such equipment in the performance of a service or the furnishing of a
product. The term information technology includes computers, ancillary
equipment, software, firmware, and similar procedures, services
(including support services), and related resources. [40 U.S.C., Sec.
1401]
Information Type
A specific category of information (e.g., privacy, medical, proprietary,
financial, investigative, contractor sensitive, security management)
defined by an organization or in some instances, by a specific law,
Executive Order, directive, policy, or regulation. [FIPS 199]
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information

C.3 Rationale and Factors for Government Resource Management

Information

Resource management functions are the back office support activities that enable the government
to operate effectively. Security objectives and impacts for resource management functions are
determined by the direct service missions and constituencies ultimately being supported. It is
likely that all Federal government information systems store, process, and operate under the
control of IT infrastructure maintenance information (e.g., password files and file and network
access settings). A basic set of security controls will apply to this information and processes to
combat potential corruption, misuse, or abuse of system information and processes.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > INFORMATION AND INFORMATION SYSTEMS

APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED

INFORMATION AND INFORMATION SYSTEMS

In general, individual agencies should identify the mission information types processed by their
systems. This Appendix identifies some information types that might be processed by Federal
government organizations. The material includes mission information and potential impacts of
unauthorized disclosure, modification, or unavailability of mission information.
The primary purpose for Federal government information systems is to support provision of
basic services to U.S. citizens and residents. This section addresses information types
associated with both services provided by the Federal government to citizens and mechanisms
used to achieve the purposes of government or deliver services for citizens. Delivery
mechanisms include financial vehicles, direct government delivery, and indirect government
delivery. Federal government missions or delivery mechanisms distributed among 26 mission
areas and modes of delivery are identified in Table D-1. Each mission area and delivery mode
corresponds to a Services to Citizens or Mode of Delivery business area as defined in the BRM
described in the FEA Consolidated Reference Model Document Version 2.3. There is not a one-
to-one mapping of services and delivery modes to government departments and agencies. Some
departments and agencies focus on a single mission. Others support multiple missions within a
mission area. Still others provide services associated with several different mission areas.
An information type is associated with each Federal government mission and delivery mode.
The identity of each information type is defined by the mission with which it is associated.
Some of the management and support functions executed to support delivery of services or
manage government resources are also executed by some agencies in delivering services to
citizens. (See especially the "General Government" functions in Section C.2.8. of Appendix C)
Most of these information types could be included in Appendix D as mission-based information
types. Because the BRM categorizes them as services delivery support functions, they are
included in Volume I, Section 4.1.2 and Appendix C and are not repeated in Appendix D.
The common impact determination factors described in Volume I, Section 4.2.3 and 4.4, also
apply to mission-based information.
Table D-1: Mission-Based Information Types and Delivery Mechanisms22
Mission Areas and Information Types
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX C: MANAGEMENT AND SUPPORT INFORMATION AND > INFORMATION SYSTEMS IMPACT LEVELS

APPENDIX C: MANAGEMENT AND SUPPORT INFORMATION AND

INFORMATION SYSTEMS IMPACT LEVELS

Much Federal government information and many systems are not employed directly to provide
services to citizens, but are primarily intended to provide administrative or business services that
support mission accomplishment. Volume I, Section 4.1.2, "Identification of Management and
Support Information," suggests a set of information types for management and support
information as based on Office of Management and Budget's (OMB) Federal Enterprise
Architecture (FEA) Business Reference Model (BRM) described in the FEA Consolidated
Reference Model Document Version 2.3, dated October 2007.
Some of the management and support functions executed to support delivery of services or
manage government resources are also executed by some agencies in delivering services to
citizens. (See especially the "C.2.8 General Government" line of business.) Most of these
information types could be included in Appendix D as mission-based information types.
Because the BRM categorizes them as services delivery support functions, they are included in
Volume I Section 4.1.2 and here in Appendix C. In order to reduce repetition, they are not
repeated in Appendix D.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information Types

C.1 Recommended Provisional Impact Levels for Management and Support

Information Types

The eight information types associated with support delivery of services as well as the five
government resources management information FEA lines of business are provided in Table
C-1. Each of the information types associated sub-functions are detailed in Appendix C.2 and
C.3. These management and support functions are the day-to-day activities necessary to provide
the critical policy, programmatic, and managerial foundation that support Federal government
operations.
Table C-1: Management and Support Lines of Business and Information Types2
Services Delivery Support Information