ezesecops/rmf-ato-core huggingface dataset:
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information

C.2 Rationale and Factors for Services Delivery Support Information

Services delivery support functions provide the critical policy, programmatic, and managerial
foundation to support Federal government operations. Security objectives and impact levels for
service delivery support information and systems are generally determined by the natures of the
supported direct services and constituencies being supported. If a system stores, processes, or
communicates national security information, it is defined as a national security system, and is
outside the scope of this guideline.12 Service delivery support activities are defined in this
section.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.1 Controls and Oversight

C.2.1 Controls and Oversight

Controls and Oversight information is used to ensure that the operations and programs of the
Federal government and its external business partners comply with applicable laws and
regulations and prevent waste, fraud, and abuse.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.2 Regulatory Development > C.2.2.2 Public Comment Tracking Information Type

C.2.2.2 Public Comment Tracking Information Type

Public Comment Tracking involves the activities of soliciting, maintaining, and responding to
public comments regarding proposed regulations. Subject to exception conditions described
below, the recommended security categorization for the public comment tracking information
type is as follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of public comment
tracking information on the ability of responsible agencies to solicit, maintain, and respond to
public comments regarding proposed regulations. The effects of loss of confidentiality of
information associated with the public comment process are unlikely to pose the threat of serious
harm to agency assets, personnel or operations.
In a few cases, the rationale for public comments can include information that is sensitive in
terms of proprietary information sensitive Federal government information, or even national
security information. However, such cases are exceptional and the information in question
would be expected to be representative of information types covered elsewhere in this guideline.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for public comment tracking information is low.
not on the time required to detect the modification or destruction of information.
Unauthorized modification or destruction of information affecting external communications that
contain public comment tracking information (e.g., web pages, electronic mail) may adversely
affect operations or public confidence in the agency, but the damage to the mission would
usually be limited.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
public comment tracking information is low.
mission, not on the time required to re-establish access to the public comment tracking
information. The effects of disruption of access to public comment tracking information or
information systems can delay development of standards, guidelines, or regulations.
The public comment tracking process is usually tolerant of delays. Permanent loss of comment
information may disrupt some government operations by showing a lack of due diligence in
response to comments.
Recommended Availability Impact Level: The provisional availability impact level recommended for
public comment tracking information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.2 Regulatory Development > C.2.2.3 Regulatory Creation Information Type

C.2.2.3 Regulatory Creation Information Type

Regulatory Creation involves the activities of researching and drafting proposed and final
regulations. Subject to exception conditions described below, the recommended security
categorization for the regulatory creation information type is as follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The level of confidentiality impact level is the effect of unauthorized disclosure of regulatory
creation information on the ability of responsible agencies to research and draft proposed and
final regulations. The effects of loss of confidentiality of early drafts of regulations can result in
attempts by affected entities and other affected parties to influence and/or impede the regulation
development process.
Special Factors Affecting Confidentiality Impact Determination: Premature public release of draft
regulations before internal coordination and review has been conducted can result in unnecessary
criticism of the proposed regulation and even damage public confidence in the agency. In such
cases, the provisional confidentiality impact level recommended for regulatory creation
information is moderate. These consequences are particularly likely where the release includes
unedited internal commentary and discussion. Delays can impair an agency's mission, but loss
of public confidence can do serious and persistent harm to an agency's ability to effectively
perform its mission. If the regulatory information is moved to the public domain, the
confidentiality impact level becomes Not Applicable (NA).
Recommended Confidentiality Impact Level: Because most regulatory information is intended for
release to the public, the provisional confidentiality impact level recommended for regulatory
creation information is low.
not on the time required to detect the modification or destruction of information.
Special Factors Affecting Integrity Impact Determination: Unauthorized modification or destruction
of information affecting external communications that contain regulatory information (e.g., web
pages, electronic mail) may adversely affect operations or public confidence in the agency. The
consequences of a reduction in public confidence will be more serious for agencies that have
national defense, intelligence, or information security missions. In such cases, the impact level
may be at least moderate.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
regulatory creation information is low.
mission, not on the time required to re-establish access to the regulatory creation information.
The regulatory creation process is usually tolerant of delays.
Recommended Availability Impact Level: The provisional availability impact level recommended for
regulatory creation information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.2 Regulatory Development > C.2.2.4 Rule Publication Information Type

C.2.2.4 Rule Publication Information Type

Rule Publication includes all activities associated with the publication of a proposed or final rule
in the Federal Register and Code of Federal Regulations. Subject to exception conditions
described below, the recommended security categorization for the rule publication information
type is as follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of rule publication
information on the ability of responsible agencies to publish proposed or final rules in the
Federal Register and Code of Federal Regulations. The published rules are, by definition, public
information.
The effects of loss of confidentiality of information associated with the rule publication process
are unlikely to pose the threat of serious harm to agency assets, personnel or operations.
Recommended Confidentiality Impact Level: In general, the provisional confidentiality impact level
recommended for rule publication information is low.
not on the time required to detect the modification or destruction of information.
In the worst cases, errata can be published. Unauthorized modification or destruction of
information may result in unnecessary expenditures, some confusion, and limited damage to
public confidence in the agency.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for rule
publication information is low.
mission, not on the time required to re-establish access to the rule publication information.
Rule publication processes are usually tolerant of delays.
Recommended Availability Impact Level: The provisional availability impact level recommended for
rule publication information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.3 Planning and Budgeting

C.2.3 Planning and Budgeting

Planning and Budgeting involves the activities of determining strategic direction, identifying
and establishing programs and processes to enable change, and allocating resources (capital
and labor) among those programs and processes.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.3 Planning and Budgeting > C.2.3.6 Workforce Planning Information Type

C.2.3.6 Workforce Planning Information Type

Workforce Planning involves the processes for identifying the workforce competencies required
to meet the agency's strategic goals and for developing the strategies to meet these requirements.
The recommended security categorization for workforce planning information is as follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of workforce planning
information on the ability of responsible agencies to identify workforce competencies required to
meet the agency's strategic goals and for developing the strategies to meet these requirements.
Unauthorized disclosure of most workforce planning information will have only a limited
adverse effect on agency operations, assets, or individuals.
Special Factors Affecting Confidentiality Impact Determination: Unauthorized disclosure of some
background information that supports development of Federal workforce plans can reveal
sensitive vulnerabilities, tables of organization, capabilities, or methods of anti-terrorism, law
enforcement, or national security activities. Depending on the information in question, the
confidentiality impact can be moderate, high, or involve national security information (outside
the scope of this guideline).
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for workforce planning information is low.
not on the time required to detect the modification or destruction of information. Therefore,
consequences of undetected unauthorized modification or destruction of workforce planning
information may compromise the effectiveness of compliance enforcement actions (e.g., by
providing violators with a basis for claiming investigative or enforcement irregularities).
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
workforce planning information is low.
mission, not on the time required to re-establish access to the workforce planning information.
The workforce planning processes are generally tolerant of reasonable delays. In most cases,
disruption of access to workforce planning information can be expected to have only a limited
adverse effect on agency operations, agency assets, or individuals.
Recommended Availability Impact Level: The provisional availability impact level recommended for
workforce planning information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.4 Internal Risk Management and Mitigation

C.2.4 Internal Risk Management and Mitigation

Internal risk management and mitigation involves all activities relating to the processes of
analyzing exposure to risk and determining appropriate counter-measures. Note that risks to
information and information systems associated with internal risk management and
mitigation activities may inherently affect the resistance to compromise/damage and recovery
from damage with respect to a broad range of critical infrastructures and key national assets.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.5 Revenue Collection

C.2.5 Revenue Collection

Revenue Collection includes the collection of Government income from all sources. Note: Tax
collection is accounted for under the Taxation Management information type in the General
Government mission area.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.5 Revenue Collection > C.2.5.2 User Fee Collection Information Type

C.2.5.2 User Fee Collection Information Type

User fee Collection involves the collection of fees assessed on individuals or organizations for
the provision of Government services and for the use of Government goods or resources (i.e.
National Parks). The recommended security categorization for the user fee collection
information type is as follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Moderate)}
The confidentiality impact level is the effect of unauthorized disclosure of user fee collection
information on the ability of responsible agencies to correctly and efficiently enforce, regulate,
and effect the collection of fees assessed on individuals or organizations for the provision of
Government services and for the use of Government goods or resources. In general, particularly
in aggregate, this information is public record.
Recommended Confidentiality Impact Level: The recommended provisional confidentiality impact
level for user fee collection information is low.
not on the time required to detect the modification or destruction of information. For example,
there may be some circumstances when the unauthorized modification or destruction of user fee
collection information is undertaken as part of a scheme to divert payments, conceal
underpayment of failure to make payment of fees, or otherwise defraud the government. In
addition, the consequences of unauthorized modification or destruction of user fee collection
information may depend on the urgency with which the information is needed or the immediacy
with which the information is used. In most cases, it is unlikely that the information will be
needed urgently or acted upon immediately.
Special Factors Affecting Integrity Impact Determination: Unauthorized modification or destruction
of information affecting external communications might have an adverse effect on agency
operations, image and reputation. The integrity impact level assigned may be moderate.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for user
fee collection information is low.
mission, not on the time required to re-establish access to the user fee collection information.
The missions supported by user fee collection information are generally tolerant of delay.
However, any extended period of unavailability would likely be seriously disruptive to the
operations for which fees are collected.
Recommended Availability Impact Level: The provisional availability impact level recommended for
user fee collection information is moderate.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.6 Public Affairs

C.2.6 Public Affairs

Public Affairs activities involve the exchange of information and communication between
the Federal Government, citizens and stakeholders in direct support of citizen services, public
policy, and/or national interest.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.6 Public Affairs > C.2.6.3 Product Outreach Information Type

C.2.6.3 Product Outreach Information Type

Product Outreach relates to the marketing of government services products, and programs to the
general public in an attempt to promote awareness and increase the number of
customers/beneficiaries of those services and programs. The recommended security
categorization for the product outreach information type is as follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of product outreach
information on the ability of responsible agencies to market government services products, and
programs to the general public in an attempt to promote awareness and increase the number of
customers/beneficiaries of those services and programs. Product outreach information is usually
in the public domain and poses no confidentiality impact.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for product outreach information is low.
not on the time required to detect the modification or destruction of information. In most cases,
the adverse effect of unauthorized modification or destruction of product outreach information
on overall agency mission functions will be limited.
Special Factors Affecting Integrity Impact Determination: The unauthorized modification or
destruction of product outreach information may result in distribution of false and misleading
information. Such events may adversely affect operations or public confidence in the agency
and may significantly degrade the product marketing mission capability. In such cases, a
moderate integrity impact may exist.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
product outreach information is low.
mission, not on the time required to re-establish access to the product outreach information.
Product outreach processes are generally tolerant of limited delays. In most cases, disruption of
access to product outreach information can be expected to have only a limited adverse effect on
agency operations, agency assets, or individuals.
Recommended Availability Impact Level: The provisional availability impact level recommended for
product outreach information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.6 Public Affairs > C.2.6.4 Public Relations Information Type

C.2.6.4 Public Relations Information Type

Public Relations activities involve the efforts to promote an organizations image through the
effective handling of citizen concerns. The recommended security categorization for the public
relations information type is as follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of public relations
information on the ability of responsible agencies to promote an organizations image through the
effective handling of citizen concerns. Public relations information itself is usually in the public
domain and poses no confidentiality impact.
Special Factors Affecting Confidentiality Impact Determination: Internal correspondence associated
with development of public relations information can contain information, the unauthorized
disclosure of which can have a serious adverse effect on agency operations. This can result in
assignment of a moderate impact level to such information.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for public relations information is low.
not on the time required to detect the modification or destruction of information. In most cases,
the adverse effects of unauthorized modification or destruction of public relations information on
overall agency mission functions will be limited.
Special Factors Affecting Integrity Impact Determination: Unauthorized modification or destruction
of public relations information may result in distribution of false and misleading information.
Such events can be expected to adversely affect operations and/or public confidence in the
agency. This can significantly degrade the public relations mission capability. In such cases, a
moderate integrity impact may exist.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
public relations information is low.
mission, not on the time required to re-establish access to the public relations information.
Public relations processes are generally tolerant of limited delays. In most cases, disruption of
access to public relations information can be expected to have only a limited adverse effect on
agency operations, agency assets, or individuals.
Recommended Availability Impact Level: The provisional availability impact level recommended for
public relations information is low.