ezesecops/rmf-ato-core huggingface dataset:
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.7 Legislative Relations > C.2.7.1 Legislation Tracking Information Type

C.2.7 Legislative Relations

Legislative Relations involves activities aimed at the development, tracking, and amendment
of public laws through the legislative branch of the Federal Government.

C.2.7.1 Legislation Tracking Information Type

Legislation Tracking involves following legislation from conception to adoption. The
recommended security categorization for the legislation tracking information type is as follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of legislation tracking
information on the ability of responsible agencies to follow legislation from conception to
adoption. Legislation tracking information itself is usually in the public domain and poses no
confidentiality impact.
Special Factors Affecting Confidentiality Impact Determination: In some cases, internal
correspondence associated with legislation tracking information can contain information, that if
improperly disclosed, will have a serious adverse effect on agency relationships with other
agencies and with the legislative branch. This can result in assignment of a moderate impact
level to such information.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for legislation tracking information is low.
not on the time required to detect the modification or destruction of information. In most cases,
the adverse effects of unauthorized modification or destruction of legislation tracking
information on overall agency mission functions will be limited.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
legislation tracking information is low.
mission, not on the time required to re-establish access to the legislation tracking information.
Legislation tracking processes are generally tolerant of limited delays. In most cases, disruption
of access to legislation tracking information will have only a limited adverse effect on agency
operations, agency assets, or individuals.
Recommended Availability Impact Level: The provisional availability impact level recommended for
legislation tracking information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information Types > C.2.8 General Government

C.2.4 Internal Risk Management &

Mitigation
Contingency Planning
Continuity of Operations
Service Recovery

C.2.5 Revenue Collection

Debt Collection
User Fee Collection
Federal Asset Sales

C.2.6 Public Affairs

Customer Services
Official Information Dissemination
Product Outreach
Public Relations

C.2.7 Legislative Relations

Legislation Tracking
Legislation Testimony
Proposal Development
Congressional Liaison Operations

C.2.8 General Government

Central Fiscal Operations
Legislative Functions
Executive Functions
Central Property Management
Central Personnel Management
Taxation Management
Central Records & Statistics
Management
Income Information
Personal Identity and Authentication
Entitlement Event Information
Representative Payee Information
General Information
2 The recommended information types provided in NIST SP 800-60 are established from the "business areas" and
"lines of business" from OMB's Business Reference Model (BRM) section of Federal Enterprise Architecture
(FEA) Consolidated Reference Model Document Version 2.3, dated October 2007.
Table C-1: Management and Support Lines of Business and Information Types2
Government Resource Management Information
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.8 General Government

C.2.8 General Government

General Government involves the overhead costs of the Federal Government, including
legislative and executive activities; provision of central fiscal, personnel, and property activities;
and the provision of services that cannot reasonably be classified in any other service support
area. As a normal rule, all activities reasonably or closely associated with other service support
areas or information types shall be included in those service support areas or information types
rather than listed as a part of general government. This service support area is reserved for
central government management operations; most service delivery (mission-based) management
activities would not be included here. Unlike the other service support functions, some general
government information types are associated with specific organizations (e.g., Department of the
Treasury, Executive Office of the President, Internal Revenue Service).
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.8 General Government > C.2.8.12 General Information Information Type

C.2.8.12 General Information Information Type

An additional management and support sub-function information type has been defined to
address General Information as a catch-all information type that may not be defined by the FEA
BRM. As such, agencies may find it necessary to identify additional information types not
defined in the BRM and assign impact levels to those types. Agency personnel may uniquely
identify information types using a FIPS 199 process to identify information not contained neatly
in the FEA BRM.
Not all of these information types are likely to have the same impact levels. The impacts to some
information types will jeopardize system functionality and the agency mission more than other
information types. General Information impact levels must be assessed in the context of the
agencies mission.
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is based on the effects of unauthorized disclosure of
representative general information on the ability of the agency to accomplish its mission.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for general information is low.
The integrity impact level is based on the specific use of the general information and not on the
time required to detect the modification or destruction of information.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
general information is low.
The availability impact level is based on the specific use of the general information and not on
the time required to re-establish access to the general information.
Recommended Availability Impact Level: The provisional availability impact level recommended for
general information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.8 General Government > C.2.8.2 Legislative Functions Information Type

C.2.8.2 Legislative Functions Information Type

Legislative functions include the service support activities associated with costs of the
Legislative Branch other than the Tax Court, the Library of Congress, and the Government
Printing Office revolving fund. The recommended security categorization for the legislative
service support information type is as follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of legislative functions
information on the ability of responsible agencies to provide service support activities associated
with costs of the Legislative Branch other than the Tax Court, the Library of Congress, and the
Government Printing Office revolving fund. The effects of loss of confidentiality of information
associated with legislative functions can be expected to have only a limited impact on Federal
government assets, operations, or personnel welfare.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for legislative functions information is low.
not on the time required to detect the modification or destruction of information.
Misunderstandings resulting from modified information that is actually exchanged can usually be
resolved and any resulting damage to the support function from modified information that is
exchanged would usually be limited.
Unauthorized modification or destruction of information affecting external publication of
legislative service support information (e.g., web pages, electronic mail) may adversely affect
inter-agency relationships, relations with Congress, or public confidence in the agency.
However, damage to the mission would usually be limited.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
legislative functions information is low.
mission, not on the time required to re-establish access to the legislative service support
information. Legislative functions processes are usually tolerant of delays.
Special Factors Affecting Availability Impact Determination: Excessive recovery delays can result in
damage to agency reputation and to interests associated with specific legislation. This can result
in assignment of a moderate impact level to such information.
Recommended Availability Impact Level: The provisional availability impact level recommended for
legislative functions information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.8 General Government > C.2.8.3 Executive Functions Information Type

C.2.8.3 Executive Functions Information Type

Subject to exception conditions described below, the recommended provisional security
categorization for the executive information type is as follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level associated with the executive information type is associated with
executive functions. The effects of loss of confidentiality of policies and guidance during the
formative stage can result in attempts by affected entities and other interested parties to influence
and/or impede the policy and guidance development process. Premature public release of
formative policies and guidance before internal coordination and review can result in
unnecessary damage to public confidence in the executive office. These consequences may
occur when the release includes unedited internal commentary and discussion.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for executive functions information is low.
not on the time required to detect the modification or destruction of information.
Unauthorized modification or destruction of information affecting external communications that
contain executive information (e.g., web pages, electronic mail) may adversely affect public
confidence in the government.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
executive information is low.
mission, not on the time required to re-establish access to the executive information.
Recommended Availability Impact Level: The provisional availability impact level recommended for
executive functions information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.1 Administrative Management

C.3.1 Administrative Management

Administrative Management involves the day-to-day management and maintenance of the
internal infrastructure. Administrative information is usually routine and is relatively low
impact. However, some administrative management information is either very sensitive (e.g.,
logistics management for nuclear or other hazardous materials, security management
information, and security clearance management information) or critical (e.g., inventory control
and logistics management information needed to support time-critical operations). National
security information is outside the scope of this guideline. [See Appendix A, Glossary of Terms,
for a definition of national security information/systems.] Routine administrative management
information systems that do not process classified information are not usually designated
national security systems, even if they are critical to the direct fulfillment of military or
intelligence missions.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.1 Administrative Management > C.3.1.4 Travel Information Type

C.3.1.4 Travel Information Type

Travel involves the activities associated with planning, preparing, and monitoring of business
related travel for an organization's employees. The following security categorization is
recommended for the travel information type:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of travel information on
the abilities of responsible agencies to plan, prepare, and monitor business related travel for the
organization's employees. Generally, the consequences of unauthorized disclosure of the
majority of travel information will result in a limited adverse effect on agency operations, agency
assets, or individuals.
Special Factors Affecting Confidentiality Impact Determination: Unauthorized disclosure of employee
identification information coupled with credit information (e.g., name, social security number,
credit card number) can result in moderate to serious consequences for individuals and local
organizations. The Privacy Act Information provisional impact levels are documented in the
Personal Identity and Authentication information type.
Unauthorized disclosure of information concerning carrier/provider contract negotiations can
have significant financial or legal consequences and put an agency at a serious disadvantage.
Also, severe consequences may result from unauthorized disclosure of information regarding
leadership travel plans that might jeopardize personnel security or the confidentiality of sensitive
operations plans. In the most sensitive cases, the confidentiality impact level may be high.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for travel information is low.
not on the time required to detect the modification or destruction of information. The
consequences of unauthorized modification or destruction of travel information partially depends
on the urgency with which the information is normally needed and the consequences of aborted
or modified travel.
In the case of travel planning information, the effects of such modifications are generally limited
with respect to agency mission capabilities or assets. There may be scenarios in which integrity
compromise of travel information may expose Federal leadership to harm or endanger a sensitive
or critical operation. However, most such scenarios are dealt with in the context of impacts to
mission operations information (Appendix D).
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
travel information is low.
mission, not on the time required to re-establish access to the travel information. The nature of
travel processes is usually tolerant of reasonable delays, at least on the agency mission scale.
Recommended Availability Impact Level: The provisional availability impact level recommended for
travel information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.1 Administrative Management > C.3.1.5 Workplace Policy Development and Management Information Type (Intra-Agency

C.3.1.5 Workplace Policy Development and Management Information Type (Intra-Agency

Only)
Workplace policy development and management includes all activities required to develop and
disseminate workplace policies such as dress codes, time reporting requirements, telecommuting,
etc. The following security categorization is recommended for the workplace policy development
and management information type:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of workplace policy
development and management information on the abilities of responsible agencies to develop
and disseminate workplace policies such as dress codes, time reporting requirements, and
telecommuting. The consequences of unauthorized disclosure of the majority of workplace
policy development and management information will result in a limited adverse effect on
agency operations, agency assets, or individuals.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for workplace policy development and management information is low.
not on the time required to detect the modification or destruction of information. The
consequences of unauthorized modification to or destruction of workplace policy development
and management information depends primarily on the criticality of the information with respect
to agency mission capability, protection of agency assets, and safety of individuals. Typically,
the effects of modification or deletion of this information are generally limited.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
workplace policy development and management information is low.
mission, not on the time required to re-establish access to the workplace policy development and
management information. Generally, workplace policy development and management processes
are tolerant of reasonable delays.
Recommended Availability Impact Level: The provisional availability impact level recommended for
workplace policy development and management information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.2 Financial Management

C.3.2 Financial Management

Financial management involves the aggregate set of accounting practices and procedures that
allow for the accurate and effective handling of all government revenues, funding, and
expenditures. Confidentiality impacts associated with financial management information are
generally associated with the sensitivity of the existence of specific projects, programs,
and/or technologies that might be revealed by unauthorized disclosure of information. For
integrity, temporary successful frauds can affect agency image, and corrective actions are
often disruptive to agency operations. Permanent loss/unavailability of financial
management information can cripple agency operations.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.2 Financial Management > C.3.2.6 Collections and Receivables Information Type

C.3.2.6 Collections and Receivables Information Type

Collections and Receivables include deposits, fund transfers, and receipts for sales or service.
Receivable management supports activities associated with recognizing and recording debts due
to the Government, performing follow-up actions to collect on these debts, and recording cash
receipts. The recommended security categorization for the collections and receivables
information type is as follows:
Security Category = {(confidentiality, Low), (integrity, Moderate), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of collections and
receivables information on the ability of responsible agencies to recognize and record debts due
to the Government, perform follow-up actions to collect on these debts, and record cash receipts.
In most cases, unauthorized disclosure of receivable management information will have only a
limited adverse effect on agency operations, assets, or individuals.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for collections and receivables information is low.
not on the time required to detect the modification or destruction of information. An
accumulation of small changes to data or deletion of small entries can result in revenue
shortfalls. In most cases, the adverse effects of consequent negative publicity and institution of
corrective action programs on mission functions or public confidence in the agency can be
serious.
Recommended Integrity Impact Level: The provisional integrity impact recommended for
collections and receivables information is moderate.
mission, not on the time required to re-establish access to the collections and receivables
information. Collections and receivables processes are generally tolerant of delay. Typically,
disruption of access to collections and receivables information can be expected to have only a
limited adverse effect on agency operations, agency assets, or individuals.
Recommended Availability Impact Level: The provisional availability impact level recommended for
collections and receivables information is low.