Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 2: Appendices
Section 4.2.3 and 4.4.2. > C.2 Rationale and Factors for Services Delivery Support Information > C.2.3 Planning and Budgeting > C.2.3.2 Capital Planning Information Type

C.2.3.2 Capital Planning Information Type

Capital Planning involves the processes for ensuring that appropriate investments are selected for
capital expenditures. The recommended provisional security categorization for capital planning
information is as follows:
Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}
The confidentiality impact level is the effect of unauthorized disclosure of capital planning
information on the ability of responsible agencies to ensure that appropriate investments are
selected for capital expenditures. The effects of loss of confidentiality of capital investment
plans during the formative stage can result in attempts by affected entities and other interested
parties to influence and/or impede the policy and guideline development process. Premature
public release of draft plans before internal coordination and review can result in unnecessary
damage to public confidence in the agency. This is particularly likely where the release includes
unedited internal commentary and discussion. The diversion of investment funds that can result
from compromise of draft plans can pervert investment priorities in a manner that is prejudicial
to public interest. However, the consequence of loss of confidentiality of most capital planning
information is likely to do only limited harm to government assets, personnel, or missions.
Special Factors Affecting Confidentiality Impact Determination: Unauthorized disclosure of some of
the background information that supports development of capital investment plans can reveal
sensitive vulnerabilities, capabilities, or methods of anti-terrorism, law enforcement, or national
security activities. Depending on the information in question, the confidentiality impact can be
moderate, high, or involve national security information (outside the scope of this guideline).
Also, some capital investment plans of some Federal agencies contain national security
information.
Recommended Confidentiality Impact Level: The provisional confidentiality impact level
recommended for capital planning information is low.
not on the time required to detect the modification or destruction of information.
Special Factors Affecting Integrity Impact Determination: Unauthorized modification or destruction
of information affecting external communications that contain capital planning information (e.g.,
web pages, electronic mail) may adversely affect operations or public confidence in the agency,
but the damage to the mission would usually be limited. Public confidence consequences will be
more serious for agencies that have national defense, intelligence, or information security
missions. In such cases, the impact may be at least moderate.
Recommended Integrity Impact Level: The provisional integrity level recommended for capital
planning information is low.
mission, not on the time required to re-establish access to the capital planning information.
The capital planning processes are usually tolerant of delays.
Recommended Availability Impact Level: The provisional availability impact level recommended for
capital planning information is low.