Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.26

D.26 Direct Services for Citizens Military Operations Civilian Operations 22 The recommended information types provided in NIST SP 800-60 are established from the "business areas" and "lines of business" from OMB's Business Reference Model (BRM) section of Federal Enterprise Architecture (FEA) Consolidated Reference Model Document Version 2.3, dated October 2007. Table D-2 includes provisional impact assessments for each mission information type or delivery mode represented in Table D-1. In Table D-2, exceptions to provisional impact assignments are identified by displaying impact assignments in a gray font [gray font] and are described as applicable by security objective in the information type descriptions to follow. The specific descriptions are provided under the sub-heading "Special Factors Affecting [Security Objective] Impact Determination. Implementation Tip The impact levels assigned to several information types should be considered context-dependent. For example, a given information type in some agencies may include information elements, the compromise of which may endanger human life. In other agencies, the same information type may not include such elements. Many of the information types are also lifecycle-dependent. That is, information that requires protection at one stage in the system development process may be publicly accessible at a later stage or following some event. For example, information that has confidentiality attributes during the period that an agency is using it to make a decision may be public knowledge once the decision has been made (e.g., financial/budgetary information used during development of requests for proposals in procurement actions). The following sections describe information attributes that affect impact assessment for each information type. Table D-2: Security Categorization of Mission Information Defense & National Security Nat'l Security Nat'l Security Nat'l Security Homeland Security Border Control and Transportation Security Moderate Moderate Moderate Key Asset and Critical Infrastructure Protection High High High Catastrophic Defense High High High Executive Functions of the EOP23 High Moderate High Intelligence Operations24 High High High Disaster Management Disaster Monitoring and Prediction Low High High Disaster Preparedness and Planning Low Low Low Disaster Repair and Restoration Low Low Low Emergency Response Low High High 23 The identified information types are not a derivative of OMB's Business Reference Model and were added to address functions of the Executive Office of the President (EOP). 24 Where foreign intelligence information is involved, the information and information systems are categorized as national security information or systems and are outside the scope of this guideline. Table D-2: Security Categorization of Mission Information International Affairs and Commerce Foreign Affairs High High Moderate International Development and Humanitarian Aid Moderate Low Low Global Trade High High High Natural Resources Water Resource Management Low Low Low Conservation, Marine, and Land Management Low Low Low Recreational Resource Management and Tourism Low Low Low Agricultural Innovation and Services Low Low Low Energy Energy Supply Low25 Moderate26 Moderate26 Energy Conservation and Preparedness Low Low Low Energy Resource Management Moderate Low Low Energy Production Low Low Low Environmental Management Environmental Monitoring/ Forecasting Low Moderate Low Environmental Remediation Moderate Low Low Pollution Prevention And Control Low Low Low Economic Development Business and Industry Development Low Low Low Intellectual Property Protection Low Low Low Financial Sector Oversight Moderate Low Low Industry Sector Income Stabilization Moderate Low Low Community and Social Services Homeownership Promotion Low Low Low Community and Regional Development Low Low Low Social Services Low Low Low Postal Services Low Moderate Moderate Transportation Ground Transportation Low Low Low Water Transportation Low Low Low Air Transportation Low Low Low Space Operations Low High High Education Elementary, Secondary, and Vocational Education Low Low Low Higher Education Low Low Low Cultural & Historic Preservation Low Low Low Cultural & Historic Exhibition Low Low Low Workforce Management 25 High where safety of radioactive materials, highly flammable fuels, or transmission channels or control processes at risk. 26 Usually Moderate or High where mission-critical procedures are involved. Table D-2: Security Categorization of Mission Information Training and Employment Low Low Low Labor Rights Management Low Low Low Worker Safety Low Low Low Health Access to Care Low Moderate Low Population Health Management and Consumer Safety Low Moderate Low Health Care Administration Low Moderate Low Health Care Delivery Services Low High Low Health Care Research and Practitioner Education Low Moderate Low Income Security General Retirement and Disability Moderate Moderate Moderate Unemployment Compensation Low Low Low Housing Assistance Low Low Low Food and Nutrition Assistance Low Low Low Survivor Compensation Low Low Low Law Enforcement Criminal Apprehension Low Low Moderate Criminal Investigation and Surveillance Moderate Moderate Moderate Citizen Protection Moderate Moderate Moderate Leadership Protection Moderate Low Low Property Protection Low Low Low Substance Control Moderate Moderate Moderate Crime Prevention Low Low Low Trade Law Enforcement27 Moderate Moderate Moderate Litigation and Judicial Activities Judicial Hearings Moderate Low Low Legal Defense Moderate High Low Legal Investigation Moderate Moderate Moderate Legal Prosecution and Litigation Low Moderate Low Resolution Facilitation Moderate Low Low Federal Correctional Activities Criminal Incarceration Low Moderate Low Criminal Rehabilitation Low Low Low General Science and Innovation Scientific and Technological Research and Innovation Low Moderate Low Space Exploration and Innovation Low Moderate Low Knowledge Creation and Management Research and Development Low Moderate Low General Purpose Data and Statistics Low Low Low Advising and Consulting Low Low Low Knowledge Dissemination Low Low Low 27 The identified information types are not a derivative of OMB's Business Reference Model and were added to address trade law enforcement. Table D-2: Security Categorization of Mission Information Regulatory Compliance and Enforcement Inspections and Auditing Moderate Moderate Low Standards Setting/ Reporting Guideline Development Low Low Low Permits and Licensing Low Low Low Public Goods Creation and Management Manufacturing Low Low Low Construction Low Low Low Public Resources, Facility, and Infrastructure Management Low Low Low Information Infrastructure Management Low Low Low Federal Financial Assistance Federal Grants (Non-State) Low Low Low Direct Transfers to Individuals Low Low Low Subsidies Low Low Low Tax Credits Moderate Low Low Credits and Insurance Direct Loans Low Low Low Loan Guarantees Low Low Low General Insurance Low Low Low Transfers to State/Local Governments Formula Grants Low Low Low Project/Competitive Grants Low Low Low Earmarked Grants Low Low Low State Loans Low Low Low Direct Services for Citizens Military Operations28 N/A N/A N/A Civilian Operations28 N/A N/A N/A