Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.4 Supply Chain Management > C.3.4.1 Goods Acquisition Information Type

C.3.4 Supply Chain Management

Supply chain management involves the purchasing, tracking, and overall management of
goods and services.

C.3.4.1 Goods Acquisition Information Type

Goods acquisition involves the procurement of physical goods, products, and capital assets to be
used by the Federal government. The recommended security categorization for the goods
acquisition information type is as follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of goods acquisition
information on the ability of agencies to procure physical goods, products, and capital assets to
be used by the Federal government. The consequences of unauthorized disclosure of most goods
acquisition information will have only a limited adverse effect on agency operations, agency
assets, or individuals.
Special Factors Affecting Confidentiality Impact Determination: Unauthorized disclosure of
information associated with large procurements can result in fraud, waste, abuse, and/or legal
proceedings that can have a serious to severe effect on Federal government assets and operations.
Also, information associated with acquisition of many Federal government facilities can be
useful to criminals seeking to gain access to those facilities. In these cases, unauthorized
disclosure of information can have a serious adverse effect on agency operations, agency assets,
or individuals. The consequent confidentiality impact would range from moderate to high. Also,
unauthorized disclosure of one agency's goods acquisition information by another agency could
result in negative impacts on cross-jurisdictional coordination within the goods acquisition
infrastructure and the general effectiveness of organizations tasked with acquisition of
government facilities and supplies. Additionally, some procurement information associated with
proposals is proprietary. In the case of competitive procurements, much information associated
with unsuccessful bids remains proprietary following award of the contract (e.g., pricing
information). Unauthorized disclosure of proprietary information can have serious consequences
for agencies and have at least a moderate confidentiality impact level. Some procurement
information is classified. The classified information is national security related and is outside
the scope of this guideline.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for goods acquisition information is low.
not on the time required to detect the modification or destruction of information. The
consequences of unauthorized modification or destruction of goods acquisition information
usually depends on the urgency with which the information is needed or the immediacy with
which the information is used
Special Factors Affecting Integrity Impact Determination: Unauthorized modification or destruction
of information affecting external publication of goods acquisition information (e.g., web pages,
electronic mail) may adversely affect public confidence in the agency. However, damage to the
mission would usually be limited. Unauthorized modification or destruction of information
relating to procurement actions (particularly proposal information) can result in serious
disruption of procurement processes that can be important or even critical to agency operations.
In such cases, the integrity impact level can be moderate or even high.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
modification or destruction of most goods acquisition information is low.
mission, not on the time required to re-establish access to the goods acquisition information.
Functions and processes supported by most goods acquisition information are tolerant of
delays i.e., the data supporting the functions/processes are not time-critical. Typically,
disruption of access will have a limited adverse effect on agency operations (including
mission functions and public confidence in the agency), agency assets, or individuals.
Special Factors Affecting Availability Impact Determination: Exceptions may include emergency
procurements necessary to support response aspects of disaster management. In such cases,
delays may cost lives and major property damage. Consequently, the availability impact
level associated with disruption of access to goods acquisition information needed to respond
to emergencies may be high.
Recommended Availability Impact Level: The provisional availability impact level recommended for
goods acquisition information is low.