Supports the creation and dissemination of guidelines to assist in the interpretation and implementation of regulations. The overall accountability rating for this information classification is Low.
Confidentiality level = Low
The confidentiality impact level is the effect of unauthorized disclosure of policy and guidance information on the ability of responsible entities to create and disseminate guidelines to assist in the interpretation and implementation of regulations. The confidentiality impact of policy and guidance information is largely event-driven. Once a policy or guidance statement has been promulgated, most policy and guidance information is in the intranet domain. However, premature unauthorized disclosure of candidate policy and guidance material can result in disruption of the policy development process.
Known mitigating factors toward changing the confidentiality level
The effects of loss of confidentiality of guidelines during the formative stage can result in attempts by affected entities and other interested parties to influence and/or impede the policy and guideline development process. Premature release of formative policies and guidelines before internal coordination and review can result in unnecessary damage to internal confidence in the organization. This is particularly likely where the release includes unedited internal commentary and discussion. Delays can impair an entity's mission, but loss of internal confidence can do serious and persistent harm to an organization's ability to effectively perform its mission. In such cases, the provisional confidentiality impact level recommended for policy and guidance development information is moderate.
Integrity level = Low
The integrity impact level is based on the specific mission and the data supporting that mission, not on the time required to detect the modification or destruction of information.
Known mitigating factors toward changing the integrity level
Some policy and guidance information is time-critical. Unauthorized modification or destruction of information affecting external communications that contain policy and guidance development information (e.g., web pages, electronic mail) may adversely affect operations or internal confidence in the entity, but the damage to the mission would usually be limited.
Availability level = Low
The availability impact level is based on the specific mission and the data supporting that mission, not on the time required to reestablish access to the policy and guidance development information. Though some policy and guidance information is time-critical, the policy and guidance development process is usually tolerant of delays.