Table 7: Categorization of Federal Information and Information Systems
POTENTIAL IMPACT
SECURITY OBJECTIVE
LOW MODERATE HIGH
Confidentiality
Preserving authorized
restrictions on information
access and disclosure,
including means for
protecting personal privacy
and proprietary information.
[44 U.S.C., SEC. 3542]
The unauthorized disclosure
of information could be
expected to have a limited
adverse effect on
organizational operations,
organizational assets, or
individuals.
The unauthorized disclosure
of information could be
expected to have a serious
adverse effect on
organizational operations,
organizational assets, or
individuals.
The unauthorized disclosure
of information could be
expected to have a severe
or catastrophic adverse
effect on organizational
operations, organizational
assets, or individuals.
Integrity
Guarding against improper
information modification or
destruction, and includes
ensuring information non-
repudiation and authenticity.
[44 U.S.C., SEC. 3542]
The unauthorized
modification or destruction
of information could be
expected to have a limited
adverse effect on
organizational operations,
organizational assets, or
individuals.
The unauthorized
modification or destruction
of information could be
expected to have a serious
adverse effect on
organizational operations,
organizational assets, or
individuals.
The unauthorized modi-
fication or destruction of
information could be
expected to have a severe
or catastrophic adverse
effect on organizational
operations, organizational
assets, or individuals.
Availability
Ensuring timely and reliable
access to and use of
information.
[44 U.S.C., SEC. 3542]
The disruption of access to
or use of information or an
information system could be
expected to have a limited
adverse effect on
organizational operations,
organizational assets, or
individuals.
The disruption of access to
or use of information or an
information system could be
expected to have a serious
adverse effect on
organizational operations,
organizational assets, or
individuals.
The disruption of access to
or use of information or an
information system could be
expected to have a severe
or catastrophic adverse
effect on organizational
operations, organizational
assets, or individuals.
4.2.2 Common Factors for Selection of Impact Levels
Where an agency determines security impact levels and security categorization based on local
application of FIPS 199 criteria, it is recommended that the following factors be considered with
respect to security impacts for each information type.
4.2.2.1 Confidentiality Factors
Using the FIPS 199 potential impact criteria summarized in Table 7, each information type
should be evaluated for confidentiality with respect to the impact level associated with
unauthorized disclosure of (i) each known variant of the information belonging to the type and
(ii) each use of the information by the system under review. Answers to the following questions
will help in the evaluation process:
• How can a malicious adversary use the unauthorized disclosure of information to do
limited/serious/severe harm to agency operations, agency assets, or individuals?
• How can a malicious adversary use the unauthorized disclosure of information to gain
control of agency assets that might result in unauthorized modification of information,
destruction of information, or denial of system services that would result in
limited/serious/severe harm to agency operations, agency assets, or individuals?
20