Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.5 Information and Technology Management > C.3.5.8 System and Network Monitoring Information Type

C.3.5.8 System and Network Monitoring Information Type

System and Network Monitoring supports all activities related to the real-time monitoring of
systems and networks for optimal performance. System and network monitoring describes the
use of tools and observation to determine the performance and status of information systems and
is closely tied to other Information and Technology Management sub-functions. System and
network monitoring information type should be considered broadly to include an agency's
network [performance, health, and status] and security operations [intrusion monitoring,
auditing, etc.] support. Subject to exception conditions described below, the recommended
security categorization for the information management information type is as follows:
Security Category = {(confidentiality, Moderate), (integrity, Moderate), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of system and network
monitoring information on the ability of responsible agencies to perform the day-to-day
processes of real-time monitoring of systems and networks for optimal performance. The
consequences of unauthorized disclosure depend largely on the content and use of the monitoring
information gathered, retained, and reported. The unauthorized disclosure of system and
network monitoring containing architectural information, vulnerabilities, and availability
information may have a serious adverse effect on agency operations, assets, or individuals.
Special Factors Affecting Confidentiality Impact Determination: Where the system and network
monitoring information collected can be expected to have a high confidentiality impact level,
then the system and network monitoring information must be assigned a high confidentiality
impact level. When the system and network monitoring data being collected supports
information types described in this guideline, agency personnel should consider a confidentiality
impact assignment of the highest impact information type processed by the system. Depending
on the agency and the mission being supported, the sensitivity of the information can range from
low to high. (National security information and national security systems are outside the scope
of this guideline.)
Recommended Confidentiality Impact Level: Particularly in the case of architectural information (IP
addresses, etc.), vulnerabilities, and availability information, the provisional impact level
recommended for system and network monitoring information depends on the sensitivity and
criticality of system information and processes. The provisional confidentiality impact level
recommended is Moderate.
not on the time required to detect the modification or destruction of information. The
consequences of unauthorized modification or destruction of system and network monitoring
information can compromise the effectiveness of the system and impair agency network and
security operations leading to inaction or incorrect decisions and actions. The level of impact
depends on the criticality of system functionality to the agency mission
Special Factors Affecting Integrity Impact Determination: The loss of integrity for some system and
network monitoring information can be very serious for agency network and security operations,
as well as, the functionality of the information system. Additionally, a loss of integrity can have
severe consequences for the agency's mission and critical business functions. The integrity
impact level recommended for system and network monitoring information associated with
highly critical information is high.
Recommended Integrity Impact Level: Potentially serious adverse effects can be expected in most
government organizations resulting from the unauthorized modification or deletion of system
and network monitoring information. Therefore, the provisional integrity impact level
recommended for system and network monitoring information is moderate.
mission, not on the time required to re-establish access to system and network monitoring
information. The effects of disruption of access to system and network monitoring information
may temporarily impair or blind agency operations personnel from actual network and security
performance. The level of impact depends on the sensitivity of the information and the criticality
of the system to the agency mission. In most cases [the exception dual-fault situations], disruption
of access to system and network monitoring information can be expected to have only a limited
adverse effect on agency operations, agency assets, or individuals. Not many system and network
monitoring systems perform functions for which loss of availability can cause significant
degradation in mission capability, place the agency at a significant disadvantage, result in major
damage to assets, or pose a threat to human life.
Recommended Availability Impact Level: The provisional availability impact level recommended for
system and network monitoring information is low.