Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information > C.3.4 Supply Chain Management > C.3.4.2 Inventory Control Information Type

C.3.4.2 Inventory Control Information Type

Inventory control refers to the tracking of information related to procured assets and resources
with regards to quantity, quality, and location. The recommended security categorization for the
inventory control information type is as follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of inventory control
information on the ability of agencies to track information related to procured assets and
resources with regards to quantity, quality, and location. The consequences of unauthorized
disclosure of most inventory control information are likely to have only a limited adverse effect
on agency operations, agency assets, or individuals.
Special Factors Affecting Confidentiality Impact Determination: Unauthorized disclosure of
information associated with inventories of hazardous materials (e.g., radioactive materials,
toxins, bio-hazardous items, explosives) can facilitate terrorist or other criminal activities that
may result in serious effects on Federal government assets and operations and on the general
public. In general, inventory control information can be of material use to criminals seeking to
perpetrate fraud, theft, or some other criminal enterprise. In these cases too, unauthorized
disclosure of information can have a serious adverse effect on agency operations, agency assets,
or individuals. The consequent confidentiality impact of these types of criminal exploitation of
unauthorized disclosure of inventory control information would range from moderate to high.
Also, unauthorized disclosure of one agency's inventory control information by another agency
could result in negative impacts on cross-jurisdictional coordination within the inventory control
infrastructure and the general effectiveness of organizations tasked with the distribution and
accounting of government facilities and supplies. Some inventory control information is
classified. The classified information is national security related and is outside the scope of this
guideline.
Recommended Confidentiality Impact Level: Regardless of the moderate or high impact associated
with unauthorized disclosure of some inventory control information, the provisional
confidentiality impact level recommended for inventory control information is low.
not on the time required to detect the modification or destruction of information. The
consequences of unauthorized modification or destruction of inventory control information
usually depends on the urgency with which the information is needed or the immediacy with
which the information is used. In most cases, it is unlikely that the information will be needed
urgently or acted upon immediately.
Unauthorized modification or destruction of information affecting external publication of
inventory control information (e.g., web pages, electronic mail) may adversely affect public
confidence in the agency. However, damage to the mission would usually be limited.
Recommended Integrity Impact Level: The provisional integrity impact level recommended for
inventory control information is low.
mission, not on the time required to re-establish access to inventory control information.
Functions and processes supported by most inventory control information are tolerant of
delays i.e., the data supporting the functions/processes are not time-critical. Typically,
disruption of access to inventory control information will have a limited adverse effect on
agency operations (including mission functions and public confidence in the agency), agency
assets, or individuals.
Special Factors Affecting Availability Impact Determination: Exceptions may include emergency
requirements to access and distribute materials necessary for disaster management. In such
cases, delays may cost lives and major property damage. Consequently, the impact level for
inventory control information needed to respond to emergencies will be high.
Recommended Availability Impact Level: The provisional availability impact level recommended for
inventory control information is low.