Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.2 Financial Management > C.3.2.3 Funds Control Information Type

C.3.2.3 Funds Control Information Type

Funds Control includes the management of the Federal budget process including the
development of plans and programs, budgets, and performance outputs as well as financing
Federal programs and operations through appropriation and apportionment of direct and
reimbursable spending authority, fund transfers, investments and other financing mechanisms.
Funds control management includes the establishment of a system for ensuring an organization
does not obligate or disburse funds in excess of those appropriated or authorized. The
recommended security categorization for the funds control information type is as follows:
Security Category = {(confidentiality, Moderate), (integrity, Moderate), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of funds control
information on the ability of responsible agencies to develop plans and programs, budgets, and
performance outputs and outcomes; and to finance Federal programs and operations through
appropriation and apportionment of direct and reimbursable spending authority, fund transfers,
investments and other financing mechanisms.
In general, unauthorized disclosure of funds control information, particularly of budget
allocations for specific programs or program elements, can be seriously detrimental to
government interests in procurement processes. In many instances, such unauthorized disclosure
is prohibited by executive order or by law (e.g., Federal Acquisition Regulation). Premature
release of draft funds control information can yield advantages to competing interests and
seriously endanger agency operations - or even agency mission.
Special Factors Affecting Confidentiality Impact Determination: Unauthorized disclosure of funds
control information for programs that process classified or high-impact information can give
adversaries damaging insights into details of agency plans, priorities, and operations. (Classified
programs and systems are outside the scope of this guideline.) In rare cases, actions taken based
on unauthorized disclosure of funds control details can pose a threat to human life or a loss of
major assets, so the confidentiality impact would be high.
Recommended Confidentiality Impact Level: While, in many cases, unauthorized disclosure of
funds control information will have only a limited adverse effect on agency operations, assets, or
individuals, the potential for serious harm is such that the provisional confidentiality impact level
recommended for funds control information is moderate.
not on the time required to detect the modification or destruction of information. Funds control
activities are not generally time-critical. An accumulation of small changes to data or deletion of
small entries can result in budget shortfalls or cases of excessive obligations or disbursements.
Recommended Integrity Impact Level: In most cases, the adverse effects of consequent negative
publicity on mission functions, image or public confidence in the agency can be serious.
Therefore, the provisional integrity impact level recommended for funds control information is
moderate.
mission, not on the time required to re-establish access to the funds control information. Funds
control processes are generally tolerant of delay. Typically, disruption of access to funds control
information can be expected to have only a limited adverse effect on agency operations, agency
assets, or individuals.
Recommended Availability Impact Level: The provisional availability impact level recommended for
funds control information is low.