Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > Information Types > C.3.5 Information & Technology (part 1)

C.3.4 Supply Chain Management

Goods Acquisition
Inventory Control
Logistics Management
Services Acquisition

C.3.5 Information & Technology

C.3.5 Information & Technology

Management
System Development
Lifecycle/Change Management
System Maintenance
IT Infrastructure Maintenance
Information Security
Record Retention
Information Management
System and Network Monitoring
Information Sharing
Table C-2 summarizes provisional impact level recommendations for administrative,
management, and service information. Provisional impact levels are recommended for each
security objective (confidentiality, integrity, availability) and for each management and support
Federal government information type. The confidentiality, integrity, and availability impact
levels define the security category of each information type. Implementation Tip
Most government information systems access, process, and/or disseminate
more than one class of information. Security objectives and impacts
associated with all of the types of information and processes served by the
information system need to be considered in determining the system's
information security requirements. Each information type may include one or more elements. For example, benefits management
information includes employee identification information, benefit plan information for insurance
and other products, cost information, claims and reimbursement policy information, claims
procedures, etc. In some cases, different impact levels are appropriate for different information elements. For
example, elements of program monitoring information relating to remediation of information
security vulnerabilities may have a different impact level than elements of program monitoring
information relating to an office furniture upgrade. Each agency that processes an information type may process a distinct combination of elements. The authority and responsibilities assigned to each agency that processes an information type can
affect the actual impact level associated with the information within the context of that agency's
operations. In Table C-2, the existence of exceptions to provisional impact assignments are identified by
displaying impact assignments in a gray font [gray font] and are described as applicable by
security objective in the information type descriptions to follow. The specific descriptions are
provided under the sub-heading "Special Factors Affecting [Security Objective] Impact
Determination."
Appendices C.2 and C.3 identify information elements and contexts that may result in variances
from the basic impact level assignment. For example, some systems process information the
compromise of which affect national security, critical infrastructures, or key national assets. Impacts associated with such systems are either outside the scope of this document (i.e., national
security information) or may need to be adjusted upward based on the more severe consequences
of compromises. Many of the information types are also lifecycle-dependent. That is, information that requires
protection at one stage in system development or operational use of the information is publicly
accessible at a later stage or following some event. For example, information that has
confidentiality attributes during the period that an agency is using it to make a decision may be
public knowledge once the decision has been made (e.g., financial/budgetary information used
during development of requests for proposals in procurement actions). Table C-2: Type-based Impacts for Federal Information and Information Systems
Security Categorization of Management and Support Information
Controls and Oversight
Corrective Action (Policy/Regulation)
Low
Low
Low
Program Evaluation
Low
Low
Low
Program Monitoring
Low3
Low
Low
Regulatory Development
Policy and Guidance Development
Low
Low
Low
Public Comment Tracking
Low
Low
Low
Regulatory Creation
Low
Low
Low
Rule Publication
Low
Low
Low
Planning and Budgeting
Budget Formulation
Low
Low
Low
Capital Planning
Low
Low
Low
Enterprise Architecture
Low
Low
Low
Strategic Planning
Low
Low
Low
Budget Execution
Low
Low
Low
Workforce Planning
Low
Low
Low
Management Improvement
Low
Low
Low
Budgeting & Performance Integration
Low
Low
Low
Tax and Fiscal Policy
Low
Low
Low
Internal Risk Management and Mitigation
Contingency Planning
Moderate
Moderate
Moderate
Continuity of Operations
Moderate
Moderate
Moderate
3 The confidentiality impact assigned to the Program Monitoring Information Type may necessitate the highest
confidentiality impact of the information types processed by the system. Security Categorization of Management and Support Information
Service Recovery
Low
Low
Low
Revenue Collection
Debt Collection
Moderate
Low
Low
User Fee Collection
Low
Low
Moderate
Federal Asset Sales
Low
Moderate
Low
Public Affairs
Customer Services
Low
Low
Low
Official Information Dissemination
Low
Low
Low
Product Outreach
Low
Low
Low
Public Relations
Low
Low
Low
Legislative Relations
Legislation Tracking
Low
Low
Low
Legislation Testimony
Low
Low
Low
Proposal Development
Moderate
Low
Low
Congressional Liason Operations
Moderate
Low
Low
General Government
Central Fiscal Operations4
Moderate
Low
Low
Legislative Functions
Low
Low
Low
Executive Functions5
Low
Low
Low
Central Property Management
Low6
Low
Low7
Central Personnel Management
Low
Low
Low
Taxation Management
Moderate
Low
Low
Central Records and Statistics
Management
Moderate
Low
Low
Income Information8
Moderate
Moderate
Moderate
Personal Identity and Authentication8
Moderate
Moderate
Moderate
Entitlement Event Information8
Moderate
Moderate
Moderate
Representative Payee Information8
Moderate
Moderate
Moderate
General Information9
Low
Low
Low
4 Tax-related functions are associated with the Taxation Management information type. 5 The OMB Business Reference Model "Executive Function has been expanded to include general agency executive
functions as well as Executive Office of the President (EOP) functions. Strictly EOP executive functions are
treated in Appendix D, Examples of Impact Determination for Mission-Based Information and Information
Systems.