Security Objective LOW MODERATE HIGH Confidentiality Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information. [44 U.S.C., SEC. 3542] The unauthorized disclosure of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. The unauthorized disclosure of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. The unauthorized disclosure of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. Integrity Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity. [44 U.S.C., SEC. 3542] The unauthorized modification or destruction of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. The unauthorized modification or destruction of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. The unauthorized modification or destruction of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. Availability Ensuring timely and reliable access to and use of information. [44 U.S.C., SEC. 3542] The disruption of access to or use of information or an information system be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. The disruption of access to or use of information or an information system could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. The disruption of access to or use of information or an information system could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
In this section, for each interconnection between systems that are owned or operated by different organizations, provide the following information concerning the authorization for the connection to other systems or the sharing of information: Name of system Organization orDivision Type of interconnection (direct interface with database, FTP, etc.) Authorizations for interconnection (MOU/MOA/Statute/Management) Date of agreement FIPS 199 Category [Low|Moderate|High] Has system been through ISDM? [Yes|No] Name and title of authorizing official(s) For systems with numerous interconnections, a table format including the above information may be a good way to present the information. Laws, Regulations, and Policies Affecting the System List any laws, regulations, or policies that establish specific requirements for confidentiality, integrity, or availability of the system and information retained by, transmitted by, or processed by the system. General agency security requirements need not be listed since they mandate security for all systems. Each agency should decide on the level of laws, regulations, and policies to include in the system security plan. Examples might include the FBI’s Criminal Justice Information Security (CJIS) Policy, HIPAA, statutes defining confidential data, etc, or a specific statute or regulation concerning the information processed. Security Control Selection Please complete the SSC in 3 to cover security control selection. Completion Date The completion date of the SSP should be provided. The completion date should be updated whenever the plan is updated. When the system is updated, the version number in the title should be updated.