Minimum Security Requirements for Federal Information and Information Systems
Appendix III] (part 2)

The term
information technology includes computers, ancillary equipment, software, firmware and similar
procedures, services (including support services), and related resources. [40 U.S.C., SEC. 1401]
INFORMATION TYPE: A specific category of information (e.g., privacy, medical, proprietary, financial,
investigative, contractor sensitive, security management), defined by an organization or, in some
instances, by a specific law, Executive Order, directive, policy, or regulation. [FIPS Publication 199]
INTEGRITY: Guarding against improper information modification or destruction, and includes
ensuring information non-repudiation and authenticity. [44 U.S.C., SEC. 3542]
LOW-IMPACT SYSTEM: An information system in which all three security objectives (i.e.,
confidentiality, integrity, and availability) are assigned a FIPS 199 potential impact value of low. MANAGEMENT CONTROLS: The security controls (i.e., safeguards or countermeasures) for an
information system that focus on the management of risk and the management of information system
security. MEDIA: Physical devices or writing surfaces including, but not limited to, magnetic tapes, optical
disks, magnetic disks, Large-Scale Integration (LSI) memory chips, printouts (but not including
display media) onto which information is recorded, stored, or printed within an information system. MODERATE-IMPACT SYSTEM: An information system in which at least one security objective (i.e.,
confidentiality, integrity, or availability) is assigned a FIPS 199 potential impact value of moderate,
and no security objective is assigned a FIPS 199 potential impact value of high. NATIONAL SECURITY INFORMATION: Information that has been determined pursuant to Executive
Order 12958 as amended by Executive Order 13292, or any predecessor order, or by the Atomic
Energy Act of 1954, as amended, to require protection against unauthorized disclosure and is marked
to indicate its classified status. NATIONAL SECURITY SYSTEM: Any information system (including any telecommunications system)
used or operated by an agency or by a contractor of an agency, or other organization on behalf of an
agency- (i) the function, operation, or use of which involves intelligence activities; involves
cryptologic activities related to national security; involves command and control of military forces; involves equipment that is an integral part of a weapon or weapons system; or is critical to the direct
fulfillment of military or intelligence missions (excluding a system that is to be used for routine
administrative and business applications, for example, payroll, finance, logistics, and personnel
management applications); or (ii) is protected at all times by procedures established for information
that have been specifically authorized under criteria established by an Executive Order or an Act of
Congress to be kept classified in the interest of national defense or foreign policy. [44 U.S.C., SEC. 3542]
OPERATIONAL CONTROLS: The security controls (i.e., safeguards or countermeasures) for an
information system that primarily are implemented and executed by people (as opposed to systems). ORGANIZATION: A federal agency or, as appropriate, any of its operational elements. POTENTIAL IMPACT: The loss of confidentiality, integrity, or availability could be expected to have a
limited adverse effect, a serious adverse effect, or a severe or catastrophic adverse effect on
organizational operations, organizational assets, or individuals. [FIPS Publication 199]
RECORDS: All books, papers, maps, photographs, machine-readable materials, or other documentary
materials, regardless of physical form or characteristics, made or received by an agency of the United
States Government under Federal law or in connection with the transaction of public business and
preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the
organization, functions, policies, decisions, procedures, operations or other activities of the
Government or because of the informational value of the data in them. [44 U.S.C. SEC. 3301]
RISK: The level of impact on organizational operations (including mission, functions, image, or
reputation), organizational assets, or individuals resulting from the operation of an information system
given the potential impact of a threat and the likelihood of that threat occurring. RISK MANAGEMENT: The process of managing risks to organizational operations (including mission,
functions, image, or reputation), organizational assets, or individuals resulting from the operation of
an information system, and includes: (i) the conduct of a risk assessment; (ii) the implementation of a
risk mitigation strategy; and (iii) employment of techniques and procedures for the continuous
monitoring of the security state of the information system. SAFEGUARDS: Protective measures prescribed to meet the security requirements (i.e., confidentiality,
integrity, and availability) specified for an information system. Safeguards may include security
features, management constraints, personnel security, and security of physical structures, areas, and
devices. [CNSS Instruction 4009 Adapted] Synonymous with security controls and countermeasures. SANITIZATION: Process to remove information from media such that information recovery is not
possible. It includes removing all labels, markings, and activity logs. [CNSS Instruction 4009 Adapted]
SECURITY CATEGORY: The characterization of information or an information system based on an
assessment of the potential impact that a loss of confidentiality, integrity, or availability of such
information or information system would have on organizational operations, organizational assets, or
individuals. [FIPS Publication 199]
SECURITY CONTROLS: