ezesecops/rmf-ato-core huggingface dataset:
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.3 Human Resource Management > C.3.3.10 Human Resources Development Information Type

C.3.3.10 Human Resources Development Information Type

Human Resources Development designs, develops, and implements a comprehensive employee
development approach to ensure that agency employees have the right competencies and skills
for current and future work assignments. This sub-function includes conducting employee
development needs assessments; designing employee development programs; administering and
delivering employee development programs; and evaluating the overall effectiveness of the
agency's employee development approach. The recommended provisional security
categorization for human resources development information is as follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of human resources
development information on the ability of responsible agencies to design, develop, and
comprehensive employee development approach to ensure that agency employees have the right
competencies and skills for current and future work assignments. In most cases, unauthorized
disclosure of human resource development information will have only a limited adverse effect on
agency operations, assets, or individuals.
Special Factors Affecting Confidentiality Impact Determination: Where more sensitive information is
involved, it will probably be personal information subject to the Privacy Act of 1974. The
Privacy Act Information provisional impact levels are documented in the Personal Identity and
Authentication information type. This can result in assignment of a moderate impact level to
such information.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for disclosure of human resources development information is low.
not on the time required to detect the modification or destruction of information. The
consequences of unauthorized modification or destruction of human resource development
information depends mostly on the criticality of the information with respect to agency mission
capability, protection of agency assets, and safety of individuals. Although there can be serious
short-term effects for individuals, the effects of modifications or deletion of this information are
generally limited with respect to agency mission capabilities or assets.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
human resources development information is low.
mission, not on the time required to re-establish human resources development information.
Human resources development information is generally tolerant of delay. Typically, disruption
of human resources development information can be expected to have only a limited adverse
effect on agency operations, agency assets, or individuals.
Recommended Availability Impact Level: The provisional availability impact level recommended
human resources development information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.3 Human Resource Management > C.3.3.2 Staff Acquisition Information Type

C.3.3.2 Staff Acquisition Information Type

Staff Acquisition establishes procedures for recruiting and selecting high-quality, productive
employees with the right skills and competencies, in accordance with merit system principles.
This sub-function includes: developing a staffing strategy and plan; establishing an applicant
evaluation approach; announcing the vacancy, sourcing and evaluating candidates against the
competency requirements for the position; initiating pre-employment activities; and hiring
employees. The recommended provisional security categorization for staff acquisition
information is as follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of staff acquisition
information on the ability of responsible agencies to establish procedures for recruiting and
selecting high-quality, productive employees with the right skills and competencies, in
accordance with merit system principles will have only a limited adverse effect on agency
operations, assets, or individuals.
Special Factors Affecting Confidentiality Impact Determination: Where more sensitive information is
involved, it will probably be personal information subject to the Privacy Act of 1974. The
Privacy Act Information provisional impact levels are documented in the Personal Identity and
Authentication information type. This can result in assignment of a moderate impact level to
such information.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for disclosure of staff acquisition information is low.
not on the time required to detect the modification or destruction of information. The
consequences of unauthorized modification or destruction of staff acquisition information
depends mostly on the criticality of the information with respect to agency mission, protection of
agency assets, and safety of individuals. Although there can be serious short-term effects for
individuals, the effects of modifications or deletion of this information are generally limited with
respect to agency mission capabilities or assets.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for staff
acquisition information is low.
mission, not on the time required to re-establish access to staff acquisition information. Staff
acquisition processes are generally tolerant of delay. Typically, disruption of staff acquisition
information can be expected to have only a limited adverse effect on agency operations, agency
assets, or individuals.
Recommended Availability Impact Level: The provisional availability impact level recommended for
staff acquisition information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.3 Human Resource Management > C.3.3.3 Organization & Position Management Information Type

C.3.3.3 Organization & Position Management Information Type

Organization and Position Management designs, develops, and implements organizational and
position structures that create a high-performance, competency-driven framework that both
advances the agency mission and serves agency human capital needs. The recommended
provisional security categorization for organization and position management information is as
follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of organization and
position management information on the ability of responsible agencies to design, develop, and
implement organizational and position structures creating a high-performance, competency-
driven framework that both advances the agency mission and serves agency human capital needs.
In most cases, unauthorized disclosure of organization and position management information
will have only a limited adverse effect on agency operations, assets, or individuals.
Special Factors Affecting Confidentiality Impact Determination: Where more sensitive information is
involved, it will probably be personal information subject to the Privacy Act of 1974. The
Privacy Act Information provisional impact levels are documented in the Personal Identity and
Authentication information type. This can result in assignment of a moderate impact level to
such information.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for disclosure of organization and position management information is low.
not on the time required to detect the modification or destruction of information. The
consequences of unauthorized modification or destruction of organization and position
management information depends mostly on the criticality of the information with respect to
agency mission capability, protection of agency assets, and safety of individuals.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
organization and position management information is low.
mission, not on the time required to re-establish access to organization and position management
information. Organization and position management processes are generally tolerant of delay.
Typically, disruption of organization and position management information can be expected to
have only a limited adverse effect on agency operations, agency assets, or individuals.
Recommended Availability Impact Level: The provisional availability impact level recommended for
organization and position management information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.3 Human Resource Management > C.3.3.9 Separation Management Information Type

C.3.3.9 Separation Management Information Type

Separation Management conducts efficient and effective employee separation programs that
assist employees in transitioning to non-Federal employment; facilitates the removal of
unproductive, non-performing employees; and assists employees in transitioning to retirement.
The recommended provisional security categorization for separation management information is
as follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of separation
management information on the ability of responsible agencies conducts efficient and effective
employee separation programs that assist employees in transitioning to non-Federal employment;
facilitates the removal of unproductive, non-performing employees; and assists employees in
transitioning to retirement. In most cases, unauthorized disclosure of separation management
information will have only a limited adverse effect on agency operations, assets, or individuals.
Special Factors Affecting Confidentiality Impact Determination: Where more sensitive information is
involved, it will probably be personal information subject to the Privacy Act of 1974. The
Privacy Act Information provisional impact levels are documented in the Personal Identity and
Authentication information type. This can result in assignment of a moderate impact level to
such information.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for disclosure of separation management information is low.
not on the time required to detect the modification or destruction of information. The
consequences of unauthorized modification or destruction of separation management information
is generally limited with respect to agency mission capabilities or assets.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
separation management information is low.
mission, not on the time required to re-establish access separation management. Separation
management processes are generally tolerant of delay. Typically, disruption separation
management information can be expected to have only a limited adverse effect on agency
operations, agency assets, or individuals.
Recommended Availability Impact Level: The provisional availability impact level recommended
separation management information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.5 Information and Technology Management

C.3.5 Information and Technology Management

IT management involves the coordination of IT resources and systems required to support or
enable a citizen service. Impacts to information associated with the operation of IT systems
generally need to be considered even when all mission-related information processed by the
system is intended to be available to the general public. The relevant issues may be different
for integrity and availability than for confidentiality. Information that has been made public,
by definition, requires no confidentiality protection. In contrast, integrity and availability
protection cannot be maintained for copies of information that have been distributed to the
public. Integrity and availability assurance can only be maintained by maintaining copies of
information in organization-controlled information systems.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information Types > C.3.5 Information & Technology (part 2)

6 High where safety of major critical infrastructure components or key national assets is at stake. 7 Moderate or High in emergency situations where time-critical processes affecting human safety or major assets are
involved. 8 The identified information types are not a derivative of OMB's Business Reference Model and were added to
address privacy information. 9 The OMB Business Reference Model does not include a General Information information type. This information
type was added as a catch-all information type. As such, agencies may use this to identify additional information
types not defined in the BRM and assign impact levels. Security Categorization of Management and Support Information
Administrative Management
Facilities, Fleet, and Equipment Mgmt
Low6
Low7
Low7
Help Desk Services
Low
Low
Low
Security Management
Moderate
Moderate
Low
Travel
Low
Low
Low
Workplace Policy Development and
Management
Low
Low
Low
Financial Management
Asset and Liability Management
Low
Low
Low
Reporting and Information
Low
Moderate
Low
Funds Control
Moderate
Moderate
Low
Accounting
Low
Moderate
Low
Payments
Low
Moderate
Low
Collections and Receivables
Low
Moderate
Low
Cost Accounting/ Performance
Measurement
Low
Moderate
Low
Human Resource Management
HR Strategy
Low
Low
Low
Staff Acquisition
Low
Low
Low
Organization and Position Management
Low
Low
Low
Compensation Management
Low
Low
Low
Benefits Management
Low
Low
Low
Employee Performance Management
Low
Low
Low
Employee Relations
Low
Low
Low
Labor Relations
Low
Low
Low
Separation Management
Low
Low
Low
Human Resources Development
Low
Low
Low
Supply Chain Management
Goods Acquisition
Low
Low
Low
Inventory Control
Low
Low
Low
Logistics Management
Low
Low
Low
Services Acquisition
Low
Low
Low
Information & Technology Management
System Development
Low
Moderate
Low
Lifecycle/Change Management
Low
Moderate
Low
System Maintenance
Low
Moderate
Low
IT Infrastructure Maintenance10
Low
Low
Low
Information System Security
Low
Moderate
Low
10 The confidentiality impact assigned to the IT Infrastructure Maintenance Information Type may necessitate the
highest confidentiality impact of the information types processed by the system. Security Categorization of Management and Support Information
Record Retention
Low
Low
Low
Information Management11
Low
Moderate
Low
System and Network Monitoring
Moderate
Moderate
Low
Information Sharing
N/A
N/A
N/A
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.5 Information and Technology Management > C.3.5.1 System Development Information Type

C.3.5.1 System Development Information Type

System Development supports all activities associated with the in-house design and development
of software applications. The recommended security categorization for the system development
information type is as follows:
Security Category = {(confidentiality, Low), (integrity, Moderate), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of system development
information on the ability of responsible agencies to design and develop software applications in-
house. In the system development phase, a system's security configuration baseline is
established. In most cases, the system development information is not particularly sensitive and
is distributed to the users. In general, disclosure of the system development information is likely
to result in only limited adverse effects on the confidentiality of system information and
processes.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for system development information is low.
not on the time required to detect the modification or destruction of information. The
consequences of unauthorized modification or destruction of system development information
depend on the maximum aggregate sensitivity and criticality of the information and processes
associated with the system.
Special Factors Affecting Integrity Impact Determination: The Recommended Integrity Impact Level
may range from low to high to national security information (outside the scope of this
guideline).
Recommended Integrity Impact Level: The provisional integrity impact level recommended for most
system development information is moderate.
mission, not on the time required to re-establish access to system development information.
Functions and processes supported by most system development information are not time-
critical. That is, temporary disruption of access to system development information will
usually have only a limited adverse effect on agency operations (including mission functions
and public confidence in the agency), agency assets, or individuals.
Recommended Availability Impact Level: The provisional availability impact level recommended for
system development information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.5 Information and Technology Management > C.3.5.2 Lifecycle/Change Management Information Type

C.3.5.2 Lifecycle/Change Management Information Type

Lifecycle/Change Management involves the processes that facilitate a smooth evolution,
composition, and workforce transition of the design and implementation of changes to agency
resources such as assets, methodologies, systems, or procedures. The recommended security
categorization for the lifecycle/change management information type is as follows:
Security Category = {(confidentiality, Low), (integrity, Moderate), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of lifecycle/change
management information on the ability of responsible agencies to execute processes that
facilitate a smooth evolution, composition, and workforce transition of the design and
implementation of changes to agency resources such as assets, methodologies, systems, or
procedures.
Special Factors Affecting Confidentiality Impact Determination: Unauthorized disclosure of some
lifecycle/change management information can provide adversaries with intelligence information
that may be useful in efforts to compromise the system. This can result in assignment of a
moderate impact level to such information. Additionally, there are legislative mandates
prohibiting unauthorized disclosure of trade secrets. Trade secrets will generally be assigned a
moderate confidentiality impact level.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for lifecycle/change management information is low.
not on the time required to detect the modification or destruction of information. The
consequences of undetected or unauthorized modification or destruction of lifecycle/change
management information depends on the maximum aggregate sensitivity and criticality of the
information and processes associated with the system.
Special Factors Affecting Integrity Impact Determination: The Recommended Integrity Impact Level
can range from low to high to national security information (outside the scope of this guideline).
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
lifecycle/change management information is moderate.
mission, not on the time required to re-establish access to lifecycle/change management
information. Functions and processes supported by most lifecycle/change management
information are not time-critical. That is, temporary disruption of access to lifecycle/change
management information will usually have only a limited adverse effect on agency
operations (including mission functions and public confidence in the agency), agency assets,
or individuals.
Recommended Availability Impact Level: The provisional availability impact level recommended for
lifecycle/change management information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.5 Information and Technology Management > C.3.5.3 System Maintenance Information Type

C.3.5.3 System Maintenance Information Type

System Maintenance supports all activities associated with the maintenance of in-house designed
software applications. The recommended security categorization for the system maintenance
information type is as follows:
Security Category = {(confidentiality, Low), (integrity, Moderate), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of system maintenance
information on the ability of responsible agencies to maintain in-house designed software
applications. In most cases, system maintenance information is not particularly sensitive and is
distributed to the users. In general, disclosure of system maintenance information is likely to
result in only limited adverse effects on the confidentiality of system information and processes.
Recommended Confidentiality Impact Level: The provisional impact level recommended for system
maintenance information is low.
not on the time required to detect the modification or destruction of information. The
consequences of unauthorized modification or destruction of system maintenance information
can be particularly serious because specific modifications to system changes can be difficult to
identify.
Special Factors Affecting Integrity Impact Determination: The consequences of undetected or
unauthorized modification or destruction of system maintenance information may depend on the
maximum aggregate sensitivity and criticality of the information and processes associated with
the system. The Recommended Integrity Impact Level can range from low to high to national
security information (outside the scope of this guideline).
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
system maintenance information is moderate.
mission, not on the time required to re-establish access to maintenance information.
Functions and processes supported by most maintenance information are not time-critical.
That is, temporary disruption of access to maintenance information will usually have only a
limited adverse effect on agency operations (including mission functions and public
confidence in the agency), agency assets, or individuals.
Recommended Availability Impact Level: The provisional availability impact level recommended for
system maintenance information is low.