Security Objective LOW MODERATE HIGH Confidentiality The unauthorized The unauthorized The unauthorized disclosure of information disclosure of information disclosure of information Preserving authorized restrictions on could be expected to have could be expected to have could be expected to information access and disclosure, a limited adverse effect on a serious adverse effect on have a severe or including means for protecting personal organizational operations, organizational operations, catastrophic adverse privacy and proprietary information. organizational assets, or organizational assets, or effect on organizational individuals. individuals. operations, [44 U.S.C., SEC. 3542] organizational assets, or individuals. The unauthorized The unauthorized The unauthorized Integrity modification or destruction modification or destruction modification or Guarding against improper information of information could be of information could be destruction of modification or destruction, and includes expected to have a limited expected to have a serious information could be ensuring information non-repudiation and adverse effect on adverse effect on expected to have a authenticity. organizational operations, organizational operations, severe or catastrophic organizational assets, or organizational assets, or adverse effect on [44 U.S.C., SEC. 3542] individuals. individuals. organizational operations, organizational assets, or individuals. Availability The disruption of access to The disruption of access to The disruption of access or use of information or an or use of information or an to or use of information Ensuring timely and reliable access to and information system be information system could or an information system use of information. expected to have a limited be expected to have a could be expected to adverse effect on serious adverse effect on have a severe or [44 U.S.C., SEC. 3542] organizational operations, organizational operations, catastrophic adverse organizational assets, or organizational assets, or effect on organizational individuals. individuals. operations, organizational assets, or individuals.
Security Objective LOW MODERATE HIGH Confidentiality Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information. [44 U.S.C., SEC. 3542] The unauthorized disclosure of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. The unauthorized disclosure of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. The unauthorized disclosure of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. Integrity Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity. [44 U.S.C., SEC. 3542] The unauthorized modification or destruction of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. The unauthorized modification or destruction of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. The unauthorized modification or destruction of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. Availability Ensuring timely and reliable access to and use of information. [44 U.S.C., SEC. 3542] The disruption of access to or use of information or an information system be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. The disruption of access to or use of information or an information system could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. The disruption of access to or use of information or an information system could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
SSPinstructions.docx