Standards for Security Categorization of Federal Information and Information Systems
3 CATEGORIZATION OF INFORMATION AND INFORMATION SYSTEMS > Security Categorization Applied to Information Systems

Security Categorization Applied to Information Systems

Determining the security category of an information system requires slightly more analysis and must
consider the security categories of all information types resident on the information system. For an
information system, the potential impact values assigned to the respective security objectives
(confidentiality, integrity, availability) shall be the highest values (i.e., high water mark) from among
those security categories that have been determined for each type of information resident on the
information system.5
The generalized format for expressing the security category, SC, of an information system is:
SC information system = {(confidentiality, impact), (integrity, impact), (availability, impact)},
where the acceptable values for potential impact are LOW, MODERATE, or HIGH.
Note that the value of not applicable cannot be assigned to any security objective in the context of
establishing a security category for an information system. This is in recognition that there is a low
minimum potential impact (i.e., low water mark) on the loss of confidentiality, integrity, and
availability for an information system due to the fundamental requirement to protect the system-level
processing functions and information critical to the operation of the information system.
EXAMPLE 4: An information system used for large acquisitions in a contracting organization contains
both sensitive, pre-solicitation phase contract information and routine administrative information. The
management within the contracting organization determines that: (i) for the sensitive contract
information, the potential impact from a loss of confidentiality is moderate, the potential impact from
a loss of integrity is moderate, and the potential impact from a loss of availability is low; and (ii) for
the routine administrative information (non-privacy-related information), the potential impact from a
loss of confidentiality is low, the potential impact from a loss of integrity is low, and the potential
impact from a loss of availability is low. The resulting security categories, SC, of these information
types are expressed as:
SC contract information = {(confidentiality, MODERATE), (integrity, MODERATE), (availability, LOW)},
and
SC administrative information = {(confidentiality, LOW), (integrity, LOW), (availability, LOW)}.
The resulting security category of the information system is expressed as:
SC acquisition system = {(confidentiality, MODERATE), (integrity, MODERATE), (availability, LOW)},
representing the high water mark or maximum potential impact values for each security objective from
the information types resident on the acquisition system.
5 It is recognized that information systems are composed of both programs and information. Programs in execution
within an information system (i.e., system processes) facilitate the processing, storage, and transmission of information
and are necessary for the organization to conduct its essential mission-related functions and operations. These system
processing functions also require protection and could be subject to security categorization as well. However, in the
interest of simplification, it is assumed that the security categorization of all information types associated with the
information system provide an appropriate worst case potential impact for the overall information system-thereby
obviating the need to consider the system processes in the security categorization of the information system.
EXAMPLE 5: A power plant contains a SCADA (supervisory control and data acquisition) system
controlling the distribution of electric power for a large military installation. The SCADA system
contains both real-time sensor data and routine administrative information. The management at the
power plant determines that: (i) for the sensor data being acquired by the SCADA system, there is no
potential impact from a loss of confidentiality, a high potential impact from a loss of integrity, and a
high potential impact from a loss of availability; and (ii) for the administrative information being
processed by the system, there is a low potential impact from a loss of confidentiality, a low potential
impact from a loss of integrity, and a low potential impact from a loss of availability. The resulting
security categories, SC, of these information types are expressed as:
SC sensor data = {(confidentiality, NA), (integrity, HIGH), (availability, HIGH)},
and
SC administrative information = {(confidentiality, LOW), (integrity, LOW), (availability, LOW)}.
The resulting security category of the information system is initially expressed as:
SC SCADA system = {(confidentiality, LOW), (integrity, HIGH), (availability, HIGH)},
representing the high water mark or maximum potential impact values for each security objective
from the information types resident on the SCADA system. The management at the power plant
chooses to increase the potential impact from a loss of confidentiality from low to moderate reflecting
a more realistic view of the potential impact on the information system should there be a security
breach due to the unauthorized disclosure of system-level information or processing functions. The
final security category of the information system is expressed as:
SC SCADA system = {(confidentiality, MODERATE), (integrity, HIGH), (availability, HIGH)}.
Table 1 summarizes the potential impact definitions for each security objective-confidentiality,
integrity, and availability.
POTENTIAL IMPACT
Security Objective
LOW
MODERATE
HIGH
Confidentiality
Preserving authorized
restrictions on information
access and disclosure,
including means for
protecting personal
privacy and proprietary
information.
[44 U.S.C., SEC. 3542]
The unauthorized
disclosure of information
could be expected to have
a limited adverse effect on
organizational operations,
organizational assets, or
individuals.
The unauthorized
disclosure of information
could be expected to have
a serious adverse effect on
organizational operations,
organizational assets, or
individuals.
The unauthorized
disclosure of information
could be expected to have
a severe or catastrophic
adverse effect on
organizational operations,
organizational assets, or
individuals.
Integrity
Guarding against improper
information modification
or destruction, and
includes ensuring
information non-
repudiation and
authenticity.
[44 U.S.C., SEC. 3542]
The unauthorized
modification or
destruction of information
could be expected to have
a limited adverse effect on
organizational operations,
organizational assets, or
individuals.
The unauthorized
modification or
destruction of information
could be expected to have
a serious adverse effect on
organizational operations,
organizational assets, or
individuals.
The unauthorized
modification or
destruction of information
could be expected to have
a severe or catastrophic
adverse effect on
organizational operations,
organizational assets, or
individuals.
Availability
Ensuring timely and
reliable access to and use
of information.
[44 U.S.C., SEC. 3542]
The disruption of access to
or use of information or an
information system could
be expected to have a
limited adverse effect on
organizational operations,
organizational assets, or
individuals.
The disruption of access to
or use of information or an
information system could
be expected to have a
serious adverse effect on
organizational operations,
organizational assets, or
individuals.
The disruption of access to
or use of information or an
information system could
be expected to have a
severe or catastrophic
adverse effect on
organizational operations,
organizational assets, or
individuals.
TABLE 1: POTENTIAL IMPACT DEFINITIONS FOR SECURITY OBJECTIVES