Supports the enforcement functions necessary to remedy programs that have been found noncompliant with a given law, regulation, or policy. The overall accountability rating for this information classification is Low.
Confidentiality level = Low
The confidentiality impact level is the effect of unauthorized disclosure of corrective action information on the ability of responsible entities to remedy internal or external programs that have been found noncompliant with a given law, regulation, policy, standard, or procedure. Unauthorized disclosure of most corrective action information should have only a limited adverse effect on entity operations, assets, or individuals.
Known mitigating factors toward changing the confidentiality level
Where more sensitive information is involved, it will probably be personal information subject to various state, national, and international privacy laws. Such information will often be assigned a moderate confidentiality impact level. Additionally, there are legislative mandates prohibiting unauthorized disclosure of trade secrets. Trade secrets will generally be assigned a moderate confidentiality impact level.
Integrity level = Low
The consequences of undetected unauthorized modification or destruction of corrective action information can conceivably compromise the effectiveness of compliance enforcement actions (e.g., by providing violators with a basis for claiming investigative or enforcement irregularities, thus supporting legal challenges to proposed corrective actions). The integrity impact level is based on the specific mission and the data supporting that mission, not on the time required to detect the modification or destruction of information. Unauthorized modification or destruction of most corrective action information should have only a limited adverse effect on entity operations, assets, or individuals.
Availability level = Low
The availability impact level is based on the specific mission and the data supporting that mission, not on the time required to reestablish access to the corrective action information. The availability impact is also dependent on whether the data is time-critical. In most cases, disruption of access to corrective action information can be expected to have only a limited adverse effect on organizational operations, organizational assets, or individuals.