Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
Appendix D, “Examples of Impact Determination for Mission-based Information and > Information Type Impact Levels

4.3 Step 3: Review Provisional Impact Levels and Adjust/Finalize

Information Type Impact Levels

In Step 3, organizations should review and adjust the provisional security impact levels for
the security objectives of each information type and arrive at a finalized state. To accomplish
this, organizations should: (i) review the appropriateness of the provisional impact levels
based on the organization, environment, mission, use, and data sharing; (ii) adjust the
security objective impact levels as necessary using the special factors18 guidance found in
Volume II, Appendices C and D; and (iii) document all adjustments to the impact levels and
provide the rationale or justification for the adjustments.
When security categorization impact levels recommended in Section 4.2 or Volume II,
Appendices C and D are adopted as provisional security impact levels, the agency should
review the appropriateness of the provisional impact levels in the context of the organization,
environment, mission, use, and data sharing associated with the information system under
review. This review should include the agency's mission importance; lifecycle and
timeliness implications; configuration and security policy related information; special
handling requirements; etc. The FIPS 199 factors presented in Section 4.2.2 of this
document should be used as the basis for decisions regarding adjustment or finalization of the
provisional impact levels. The confidentiality, integrity, and availability impact levels may
be adjusted one or more times in the course of the review. Once the review and adjustment
process is complete, the mapping of impact levels by information type can be finalized.
The impact of information compromise of a particular type can vary in different agencies or
in dissimilar operational contexts. Also, the impact for an information type may vary
throughout the life cycle. For example, contract information that has a moderate
confidentiality impact level during the life of the contract may have a low impact level when
the contract is completed. Policy information may have moderate confidentiality and
integrity impact levels during the policy development process, low confidentiality and
moderate integrity impact levels when the policy is implemented, and low confidentiality and
integrity impact levels when the policy is no longer used.
18 The special factor guidance in NIST SP 800-60, Volume II, provides specific guidance on considerations for
adjusting each security objective (confidentiality, integrity, and availability) for each information type. The
special factor guidance is applied to each information type, based on how the information type is used, the
organization's mission, or the system's operating environment.
The impact levels associated with the management and support information common to many
agencies are strongly affected by the mission-based information with which it is associated. That
is, agency-common management and support information used with very sensitive or critical
mission-based information types may have higher impact levels than the same agency-common
information used with less critical mission-based information types.
Further, information systems process many types of information. Not all of these information
types are likely to have the same security impact levels. The compromise of some information
types will jeopardize system functionality and agency mission more than the compromise of
other information types. System security impact levels must be assessed in the context of system
mission and function as well as on the basis of the aggregate of the component information
types.
Additionally, configuration and security policy enforcement information should be reviewed
and adjusted considering the information processed on the system. Configuration and
security policy information includes password files, network access rules, other hardware and
software configuration settings, and documentation affecting access to the information
system's data, programs, and/or processes. At a minimum, a low confidentiality and
integrity impact level will apply to this set of information and processes due to a potential for
corruption, misuse, or abuse of system information and processes.
A factor specific to the confidentiality objective is information subject to special handling (e.g.,
information subject to the Privacy Act of 1974, 5 U.S.C. § 552A). Regardless of other
considerations, some minimum confidentiality impact level must be assigned to any information
system that stores, processes, or generates such information. Examples of such information
include information subject to the Trade Secrets Act, the Privacy Act, Department of Energy
Safeguards Information, Internal Revenue Service Official Use Only Information, and
Environmental Protection Agency Confidential Business Information (e.g., subject to Toxic
Substances Control Act; Resource Conservation and Recovery Act; Comprehensive
Environmental Response, Compensation, and Liability Act). Some of these statutory and
regulatory specifications are listed in Volume II, Appendix E, "Legislative and Executive
Sources Establishing Sensitivity/Criticality."