Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.1 Administrative Management > C.3.1.3 Security Management Information Type

C.3.1.3 Security Management Information Type

Security Management involves the physical protection of an organization's personnel, assets, and
facilities (including security clearance management). Impacts to some information and
information systems associated with security management may affect the security of some
critical infrastructure elements and key national assets (e.g., nuclear power plants, dams, and
other government facilities). Impact levels associated with security information directly relate to
the potential threat to human life associated with the asset(s) being protected (e.g., consequences
to the public of terrorist access to dams or nuclear power plants). The following recommended
categorization of the security management information type is subject to change where critical
infrastructure elements or key national assets are involved:
Security Category = {(confidentiality, Moderate), (integrity, Moderate), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of security management
information on the ability of responsible organizations to physically protect their personnel,
assets, and facilities. The consequences of unauthorized disclosure of most security management
information depend on the likelihood that the information might jeopardize the physical security
of an organization's assets and the value, and potential for damage of the assets being protected.
Information associated with the physical security of many Federal government office buildings,
transportation fleets, and operational facilities can be of material use to criminals seeking to gain
access to Federal facilities in order to perpetrate a major crime (e.g., extraction of inmates from
Federal detention facilities, theft of commodities market projections, access to information
associated with a felony criminal investigation or prosecution, theft of blank license issuing
facilities and/or materials, access to competition-sensitive information associated with major
procurements, undetected access to national archives or museum properties, access to currency
printing facilities or materials, theft of major currency or bullion storage facilities). In such
cases, unauthorized disclosure of information can have a serious adverse effect on agency
operations, agency assets, or individuals. Unauthorized disclosure of one agency's security
management information by another agency could result in negative impacts on cross-
jurisdictional coordination within the security management infrastructure and the general
effectiveness of organizations tasked with physical protection of Federal facilities. The
consequences of physical protection failures at most Federal facilities are more likely to result in
serious21 adverse effects.
Special Factors Affecting Confidentiality Impact Determination: Information associated with security
management at other Federal government office buildings, transportation fleets, and operational
facilities can be of material use to terrorists seeking to penetrate and/or commandeer such
facilities as part of operations intended to harm critical infrastructures, key national assets, or
people. Examples of more potentially damaging information includes information that reveals
specific measures for protecting government aircraft, information that might permit access that
creates an opportunity to bomb a government building (e.g., Congressional office buildings, FBI
Headquarters, the National Archives, Smithsonian Institution buildings, dams, nuclear power
plants, etc.), and leadership protection details that could result in assassination opportunities. In
these cases, the confidentiality impact must be high.
Unauthorized disclosure of security management information that can be reasonably expected to
pose a serious threat to human life (including those of security guards) must also be assigned a
high confidentiality impact. [Security management information associated with some Federal
government assets is classified. The classified information is national security related and is
21 A loss of confidentiality that causes a significant degradation in mission capability, places the agency at a
significant disadvantage, or results in major damage to assets, requiring extensive corrective actions or repairs.
outside the scope of this guideline.] Other security management information, such as that
affecting Nuclear Regulatory Commission "SAFEGUARDS" or Internal Revenue Service
"Limited For Official Use Only" information is not national security information, but must be
treated as having high confidentiality impact.
Recommended Confidentiality Impact Level: The confidentiality impact level recommended for
most security management information is moderate.
not on the time required to detect the modification or destruction of information. The
consequences of unauthorized modification or destruction of security management information
may depend on the urgency with which the information is needed or the immediacy with which
the information is used. In cases of intrusion indications, security management information can
be time-critical.
The consequences of unauthorized modification or destruction of time-critical security
management information can reasonably be expected to result in physical security
vulnerabilities. The range of potential consequences is covered above in Confidentiality.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
most security management information is moderate.
mission, not on the time required to re-establish access to the security management information.
Functions supported by most security management information are tolerant of delays. Typically,
disruption of access to security management information will have a limited adverse effect on
agency operations (including mission functions and public confidence in the agency), agency
assets, or individuals.
Special Factors Affecting Availability Impact Determination: Exceptions may include alarm and alert
communications and interconnections for security management systems and automated control
systems that support security management processes (e.g., door and gate operations in buildings
to which access is limited such as detention facilities and many Federal office buildings For
these exceptions, the data is time-critical. The availability impact level associated with
unauthorized modification or destruction of such alarm, alert, and automated process security
management information may be high.
Recommended Availability Impact Level: The provisional availability impact level recommended for
security management information is low.