Functional Impact: None Low Moderate High HIGH Organization has lost the – ability to provide all critical services to all system users. MEDIUM Organization has lost the – ability to provide a critical service to a subset of system users. LOW - Organization has experienced a loss of efficiency, but can still provide all critical services to all users with minimal effect on performance NONE - Organization has experienced no loss in ability to provide all services to all users. Information Impact: PRIVACY The confidentiality of None Low Moderate High – personally identifiable information (PII ) or personal health information (PHI) was compromised. None Low Moderate High INTEGRITY The necessary – integrity of information was modified without authorization. NONE No information was – exfiltrated, modified, deleted or otherwise compromised. Recoverability: Time to recovery is REGULAR Regular Supplemented Extended Not Recoverable – predictable with existing resources. SUPPLEMENTED Time to – Not Applicable recovery is predictable with additional resources. Please include narratives here: EXTENDED Time to recovery is – unpredictable, additional resources and outside help are needed. NOT RECOVERABLE- Recovery from the incident is not possible (Example, PII exfiltrated and posted publically). NOT APPLICABLE Incident does – not require recovery. Section IV: Lessons Learned A. Lessons Learned How could this incident have been prevented? What additional information was required to investigate/resolve this incident? Where was this information available? What will your organization do to prevent further breaches?
Functional Impact: HIGH – Organization has lost the ability to provide all critical services to all system users. MEDIUM – Organization has lost the ability to provide a critical service to a subset of system users. LOW - Organization has experienced a loss of efficiency, but can still provide all critical services to all users with minimal effect on performance NONE - Organization has experienced no loss in ability to provide all services to all users. None Low Moderate High Information Impact: PRIVACY – The confidentiality of personally identifiable information (PII ) or personal health information (PHI) was compromised. INTEGRITY – The necessary integrity of information was modified without authorization. NONE – No information was exfiltrated, modified, deleted or otherwise compromised. None Low Moderate High None Low Moderate High Recoverability: REGULAR – Time to recovery is predictable with existing resources. SUPPLEMENTED – Time to recovery is predictable with additional resources. EXTENDED – Time to recovery is unpredictable, additional resources and outside help are needed. NOT RECOVERABLE- Recovery from the incident is not possible (Example, PII exfiltrated and posted publically). NOT APPLICABLE – Incident does not require recovery. Regular Supplemented Extended Not Recoverable Not Applicable Please include narratives here: Section IV: Lessons Learned A. Lessons Learned How could this incident have been prevented? What additional information was required to investigate/resolve this incident? Where was this information available? What will your organization do to prevent further breaches?
AD-3038%20PII-CUI%20Incident%20Report%20Form.docx