ezesecops/rmf-ato-core huggingface dataset:
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.18 Federal Correctional Activities > D.18.1

D.18.1 Criminal Incarceration Information Type Criminal incarceration includes activities associated with the housing, custody and general care of criminals sentenced to serve time in penitentiaries. The following security categorization is recommended for the criminal incarceration information type: Security Category = {(confidentiality, Low), (integrity, Moderate), (availability, Low)} The confidentiality impact level is the effect of unauthorized disclosure of criminal incarceration information on the ability of responsible agencies to provide housing, custody, and general care for criminals sentenced to serve time in a Federal penitentiary. The consequences of unauthorized disclosure of most criminal incarceration information are unlikely to have a serious adverse effect on agency operations. The most serious adverse effects are likely to involve exposure of information that is proprietary to prisoners that can result in damaging publicity for an organization. (Unauthorized disclosure of some information can conceivably have serious impact on the status or resolution of appeal actions). The consequences of unauthorized disclosures may have an adverse effect on public confidence in the agency. Recommended Confidentiality Impact Level: The provisional confidentiality impact level recommended for most criminal incarceration information is normally low. not on the time required to detect the modification or destruction of information. The consequences of unauthorized modification or destruction of criminal incarceration information can be serious if the information is time-critical and results in the premature release of a criminal, unjust retention of an individual in the prison system, or harm to a citizen's reputation or public confidence in the government. Special Factors Affecting Integrity Impact Determination: In some cases (e.g., instructions regarding a need to isolate a prisoner from the general prison population for personal safety reasons), the unauthorized modification or destruction of criminal incarceration information can result in loss of human life a high impact potential. Recommended Integrity Impact Level: The provisional integrity impact level recommended for criminal incarceration information is moderate. mission, not on the time required to re-establish access to criminal incarceration information. Criminal incarceration processes are usually tolerant of reasonable delays. Special Factors Affecting Availability Impact Determination: There may be cases (e.g. emergency bulletins affecting prisoner health and/or safety) in which emergency dissemination of information regarding life-threatening situations is delayed for excessive periods. Such cases can result in a high availability impact level. Recommended Availability Impact Level: The provisional availability impact level recommended for criminal incarceration information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.18 Federal Correctional Activities > D.18.2

D.18.2 Criminal Rehabilitation Information Type Criminal Rehabilitation includes all government activities devoted to providing convicted criminals with the educational resources and life skills necessary to rejoin society as responsible and contributing members. The recommended provisional categorization of the criminal rehabilitation information type follows: Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)} The confidentiality impact level is the effect of unauthorized disclosure of criminal rehabilitation information on the ability of responsible agencies to provide convicted criminals with the educational resources and life skills necessary to rejoin society as responsible and contributing members. The consequences of unauthorized disclosure of most criminal rehabilitation information would have a limited adverse effect on agency operations, agency assets, or individuals. Special Factors Affecting Confidentiality Impact Determination: Exceptions that might have a potential for more serious consequences are based on privacy information processed in criminal rehabilitation systems (e.g., information required by the Privacy Act of 1974 (The Privacy Act Information provisional impact levels are documented in the Personal Identity and Authentication information type) or other statutes and executive orders to receive special handling to protect the privacy of individuals). This can result in assignment of a moderate impact level to such information. Recommended Confidentiality Impact Level: The provisional confidentiality impact level recommended for criminal rehabilitation information is low. not on the time required to detect the modification or destruction of information. The consequences of unauthorized modification or destruction of criminal rehabilitation information would have a limited adverse effect on agency operations, agency assets, or individuals. Unauthorized modification or destruction of information affecting external communications (e.g., web pages, electronic mail) may adversely affect operations and/or public confidence in the agency, but the damage to the mission would usually be limited. Recommended Integrity Impact Level: The provisional integrity impact level recommended for most criminal rehabilitation information is low. mission, not on the time required to re-establish access to criminal rehabilitation information. The effects of disruption of access to most criminal rehabilitation information or information systems would have a limited adverse effect on agency operations, agency assets, or individuals. Recommended Availability Impact Level: The provisional availability impact level recommended for criminal rehabilitation information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.19

D.19 General Sciences and Innovation General Science and Innovation includes all Federal activities to meet the national need to advance knowledge in this area. This includes general research and technology programs, space exploration activities, and other research and technology programs that have diverse goals and cannot be readily classified into another mission area or information type.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.2

D.2 Homeland Security Homeland Security involves protecting the nation against terrorist attacks. This includes analyzing threats and intelligence, guarding borders and airports, protecting critical infrastructure, and coordinating the response emergencies. The Homeland Security Line of Business is defined by the President's Strategy on Homeland Security. Note: Some of the Critical Mission Areas from the President's strategy are included in other information classes and categories.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.2 Homeland Security > D.2.2

D.2.2 Key Asset and Critical Infrastructure Protection Information Type Key Asset and Critical Infrastructure Protection involves assessing key asset and critical infrastructure vulnerabilities and taking direct action to mitigate vulnerabilities, enhance security, and ensure continuity and necessary redundancy in government operations and personnel. The Critical Infrastructure Information Protection Act of 2002 (6 U.S.C. 131-134) places specific controls on the dissemination of critical infrastructure information (see Volume I, 3.5.2.3). Under the provisions of Executive Order 13292, some anti-terrorism information is subject to security classification. National security information is outside the scope of this guideline. The recommended categorization for unclassified anti-terrorism information follows: Security Category = {(confidentiality, High), (integrity, High), (availability, High)} The confidentiality impact level is the effect of unauthorized disclosure of critical infrastructure protection information on the ability of responsible agencies to monitor and assess the leadership, motivations, plans, and intentions of foreign and domestic terrorist groups and their state and non-state sponsors. The effects of unauthorized disclosure of this information can reasonably be expected to jeopardize fulfillment of critical infrastructure protection missions. The consequent threat to critical infrastructures, key national assets, and human life can be catastrophic. Recommended Confidentiality Impact Level: The provisional confidentiality impact level recommended for critical infrastructure protection information is high. not on the time required to detect the modification or destruction of information. Unauthorized modification or destruction of information affecting critical infrastructure protection operations may adversely affect mission operations and result in unacceptable damage to critical infrastructures, damage to key national assets, or loss of human life. Recommended Integrity Impact Level: The provisional integrity impact level recommended for critical infrastructure protection information is high. mission, not on the time required to re-establish access to critical infrastructure protection information. Generally, critical infrastructure protection missions are not reliably tolerant of delays. Significant degradation in mission capability and resultant catastrophic consequences for critical infrastructures, key national assets, and/or human life may occur from disruption of access to critical infrastructure protection information. Recommended Availability Impact Level: The provisional availability impact level recommended for critical infrastructure protection information is high.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.2 Homeland Security > D.2.3

D.2.3 Catastrophic Defense Information Type Catastrophic Defense involves the development of technological countermeasures (chemical, biological, radiological and nuclear [CBRN]) to terrorist threats, conducting laboratory testing on new and promising devices, and conducting basic and applied science that can lead to the development of countermeasures. Under the provisions of Executive Order 13292, some anti- terrorism information is subject to security classification. National security information is outside the scope of this guideline. The recommended categorization for unclassified anti- terrorism information follows: Security Category = {(confidentiality, High), (integrity, High), (availability, High)} The confidentiality impact level is the effect of unauthorized disclosure of catastrophic defense information on the ability of responsible agencies to monitor and assess the leadership, motivations, plans, and intentions of foreign and domestic terrorist groups and their state and non-state sponsors. The effects of unauthorized disclosure of this information can reasonably be expected to jeopardize fulfillment of catastrophic defense missions. The consequent threat to human life, critical infrastructures, and key national assets can be catastrophic. Recommended Confidentiality Impact Level: The provisional confidentiality impact level recommended for catastrophic defense information is normally high. not on the time required to detect the modification or destruction of information. Unauthorized modification or destruction of information affecting catastrophic defense activities may adversely affect mission operations in a manner that results in loss of human life, unacceptable damage to critical infrastructures, and/or damage to or loss of key national assets. Recommended Integrity Impact Level: The provisional integrity impact level recommended for catastrophic defense information is high. The effects of disruption of access to or use of catastrophic defense information or The availability impact level is based on the specific mission and the data supporting that mission, not on the time required to re-establish access to catastrophic defense information. Generally, disruption of access will have a severe adverse effect on agency operations (including mission functions and public confidence in the agency), agency assets, or individuals. Also, catastrophic defense missions are not tolerant of delays, with consequences of significant degradation in mission capability and resultant catastrophic consequences for human life, critical infrastructures, and/or key national assets. Recommended Availability Impact Level: The provisional availability impact level recommended for catastrophic defense information is high.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.2 Homeland Security > D.2.4

D.2.4 Executive Functions of the Executive Office of the President (EOP) Information Type Executive Functions involve the Executive Office of the President (EOP). Subject to exception conditions described below, the recommended provisional security categorization for the executive information type is as follows: Security Category = {(confidentiality, High), (integrity, Moderate), (availability, High)} The confidentiality impact level associated with the executive information type is associated with functions of the Executive Office of the President (EOP). The effects of loss of confidentiality of policies and guidance during the formative stage can result in attempts by affected entities and other interested parties to influence and/or impede the policy and guidance development process. Premature public release of formative policies and guidance before internal coordination and review can result in unnecessary damage to public confidence in the EOP. These consequences may occur when the release includes unedited internal commentary and discussion. Most of the information processed in and by the EOP is classified national security information and is outside the scope of this guideline. Other information processed by the EOP is extremely sensitive and applicable to homeland security and law enforcement. The unauthorized disclosure of this extremely sensitive information can seriously imperil human life, key national assets, and critical infrastructures. Recommended Confidentiality Impact Level: Based on the catastrophic harm that can be suffered by the nation due to unauthorized disclosure of executive information the provisional confidentiality impact level recommended for executive functions information is high. not on the time required to detect the modification or destruction of information. Unauthorized modification or destruction of information affecting external communications that contain EOP information (e.g., web pages, electronic mail) may adversely affect public confidence in the government. In the case of the EOP, the impact of such a loss of public confidence may be at least moderate. Recommended Integrity Impact Level: The provisional integrity impact level recommended for executive information is moderate. mission, not on the time required to re-establish access to the executive information. National defense and critical infrastructure protection aspects of EOP functions are not generally tolerant of delays. Excessive recovery delays can result in loss of coordination of critical defense and public welfare processes. Recommended Availability Impact Level: The provisional availability impact level recommended for executive functions information is high.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.20

D.20 Knowledge Creation and Management Knowledge Creation and Management involves the programs and activities in which the Federal Government creates or develops a body or set of knowledge, the manipulation and analysis of which can provide inherent benefits for both the Federal and private sector.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.20 Knowledge Creation and Management > D.20.3

D.20.3 Advising and Consulting Information Type Advising and Consulting activities involve the guidance and consultative services provided by the Federal Government to support the implementation of a specific service provided to citizens. The recommended provisional categorization of the advising and consulting information type follows: Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)} The confidentiality impact level is the effect of unauthorized disclosure of advising and consulting information on the ability of responsible agencies to provide guidance and consultative services to support the implementation of a specific service to citizens. The consequences of unauthorized disclosure of advising and consulting information depends on the nature of the service being provided and on the sensitivity of the information with which advisory or consulting entities are working. The consequences of unauthorized disclosure of most advising and consulting information would have a limited adverse effect on agency operations, agency assets, or individuals. Special Factors Affecting Confidentiality Impact Determination: Where consulting support involves classified or other national security information, the consequences of unauthorized disclosure can be severe but are outside the scope of this guideline. In other cases, such as consultative services provided to law enforcement institutions, the consequences of unauthorized disclosure can be serious or even life threatening. This can result in assignment of a moderate or high impact level to such information. Recommended Confidentiality Impact Level: The provisional confidentiality impact level recommended for advising and consulting information is low. not on the time required to detect the modification or destruction of information. The consequences of unauthorized modification or destruction of advising and consulting information would have, at most, a limited adverse effect on agency operations, agency assets, or individuals. Unauthorized modification or destruction of information affecting external communications (e.g., web pages, electronic mail) may adversely affect operations and/or public confidence in the agency, but the damage to the mission would usually be limited. Recommended Integrity Impact Level: The provisional integrity impact level recommended for advising and consulting information is low. mission, not on the time required to re-establish access to advising and consulting information. The effects of disruption of access to most advising and consulting information or information systems would have limited adverse effect on agency operations, agency assets, or individuals. Recommended Availability Impact Level: The provisional availability impact level recommended for advising and consulting information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.21

D.21 Regulatory Compliance and Enforcement Regulatory Compliance and Enforcement involves the direct monitoring and oversight of a specific individual, group, industry, or community participating in a regulated activity via market mechanisms, command and control features, or other means to control or govern conduct or behavior.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.21 Regulatory Compliance and Enforcement > D.21.3

D.21.3 Permits and Licensing Information Type Permits and Licensing involves activities associated with granting, revoking, and the overall management of the documented authority necessary to perform a regulated task or function. The following security categorization is recommended for the permits and licensing information type: Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)} The confidentiality impact level is the effect of unauthorized disclosure of permits and licensing information on the abilities of responsible agencies to manage the documented authority necessary to perform a regulated task or function. The consequences of unauthorized disclosure of the majority of permits and licensing information will result in a limited adverse effect on agency operations, agency assets, or individuals. Special Factors Affecting Confidentiality Impact Determination: Where more sensitive information is involved, it will typically be personal information subject to the Privacy Act of 1974, the Health Insurance Portability and Accountability Act of 1996, or other laws and executive orders affecting the dissemination of information regarding individuals. The Privacy Act Information provisional impact levels are documented in the Personal Identity and Authentication information type. In such cases, the consequences of unauthorized disclosure of permits and licensing information could be serious. In such cases, the confidentiality impact level might be moderate. Recommended Confidentiality Impact Level: The provisional confidentiality impact level recommended for most permits and licensing information is low. not on the time required to detect the modification or destruction of information. The consequences of unauthorized modification or destruction of permits and licensing information depends primarily on the criticality of the regulated activity with respect to protection of government assets, and safety of individuals. Typically, the effects of modification or deletion of permits and licensing information are limited with respect to agency missions or assets. Recommended Integrity Impact Level: The provisional integrity impact level recommended for permits and licensing information is low. mission, not on the time required to re-establish access to permits and licensing information. The nature of permits and licensing processes is tolerant of reasonable delays. Recommended Availability Impact Level: The provisional availability impact level recommended for permits and licensing information is low.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED > D.22

D.22 Public Goods Creation and Management The construction, manufacturing, administration, and/or management of goods, structures, facilities, common resources, etc. used for the general well being of the American public or society at large.