Impact is assessed based on the degree to which an incident or event adversely affects, or has the potential to affect, the successful accomplishment of operational missions and the confidentiality, integrity, or availability of DoD information networks and ISs. Each cyber event or incident is assessed and assigned an impact as part of the incident handling process. An impact assessment is one of the determining factors when assigning priority to an incident or event. The category and impact guide reporting timelines and response actions should be commensurate with the magnitude of the incident or event. The following describes the categorization system for assigning impact levels to incidents or events. This table is intended to provide a high-level overview of each security objective and define impact levels across these objectives. Potential Impact Security Objective Low Moderate High Confidentiality. Preserving authorized The unauthorized The unauthorized The unauthorized restrictions on information access and disclosure of disclosure of disclosure of disclosure, including means for information could be information could information could be protecting personal privacy and expected to have a be expected to expected to have a proprietary information. [44 limited adverse effect have a serious severe or catastrophic U.S.C. 3542]. on organizational adverse effect on adverse effect on operations, organizational organizational organizational assets, operations, operations, or individuals. organizational organizational assets, assets, or or individuals. individuals. Integrity. Guarding against improper The unauthorized The unauthorized The unauthorized information modification or modification or modification or modification or destruction, and includes ensuring destruction of destruction of destruction of information nonrepudiation and information could be information could information be authenticity. [44 U.S.C. 3542]. expected to have a be expected to expected to have a limited adverse effect have a serious severe or catastrophic on organizational adverse effect on adverse effect on operations, organizational organizational organizational assets, operations, operations, or individuals. organizational organizational assets, assets, or or individuals. individuals. Availability. Ensuring timely and The disruption of The disruption of The disruption of reliable access to and use of access to or use of access to or use of access to or use of information. [44 information or an information or an information or an information system information system information system be expected to could be expected could be expected to have a limited adverse to have a serious have a severe or effect on adverse effect on catastrophic adverse organizational organizational effect on operations, operations, organizational organizational assets, organizational operations, or individuals. assets, or organizational assets, individuals. or individuals. Table - Impact Levels
Impact is assessed based on the degree to which an incident or event adversely affects, or has the potential to affect, the successful accomplishment of operational missions and the confidentiality, integrity, or availability of DoD information networks and ISs. Each cyber event or incident is assessed and assigned an impact as part of the incident handling process. An impact assessment is one of the determining factors when assigning priority to an incident or event. The category and impact guide reporting timelines and response actions should be commensurate with the magnitude of the incident or event. The following describes the categorization system for assigning impact levels to incidents or events. This table is intended to provide a high-level overview of each security objective and define impact levels across these objectives. Potential Impact Security Objective Low Moderate High Confidentiality. Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information. [44 U.S.C. 3542]. The unauthorized disclosure of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. The unauthorized disclosure of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. The unauthorized disclosure of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. Integrity. Guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity. [44 U.S.C. 3542]. The unauthorized modification or destruction of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. The unauthorized modification or destruction of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. The unauthorized modification or destruction of information be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. Availability. Ensuring timely and reliable access to and use of information. [44 The disruption of access to or use of information or an information system be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. The disruption of access to or use of information or an information system could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. The disruption of access to or use of information or an information system could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. Table - Impact Levels
RMF_Incident-Response-Plan.docx