Supports the design, creation, and production of organizational goods and services. The overall accountability rating for this information classification is Moderate.
Confidentiality level = Low
The confidentiality impact level is the effect of unauthorized disclosure of goods and services production information on the ability of entities to oversee and/or manage contractors and service providers from third parties. The consequences of unauthorized disclosure of most goods and services production information are likely to have only a limited adverse effect on organizational operations, organizational assets, or individuals.
Known mitigating factors toward changing the confidentiality level
Unauthorized disclosure of information associated with very large production systems can result in fraud, waste, abuse, and/or legal proceedings that can have a serious effect on organizational assets and operations. Also, information associated with production of some services (e.g., security or protection services) can be of material use to criminals seeking to gain access to organizational facilities or information in order to facilitate or perpetrate sabotage, murder, fraud, theft, or other criminal enterprises. In these cases, unauthorized disclosure of information can have a serious adverse effect on organizational operations, organizational assets, and/or individuals. The consequent confidentiality impact will range from moderate to high. Additionally, some production information associated with proposals is proprietary. In the case of competitive products and services, much information associated with unsuccessful bids remains proprietary following award of the contract (e.g., pricing information). Unauthorized disclosure of proprietary information can have serious consequences for entities and have at least a moderate confidentiality impact level. Some goods and services production information is classified. The classified information is trade secret related and is outside the scope of this guideline.
Integrity level = Moderate
The integrity impact level is based on the specific mission and the data supporting that mission, not on the time required to detect the modification or destruction of information. The consequences of unauthorized modification or destruction of goods and services production information usually depends on the urgency with which the information is needed or the immediacy with which the information is used. In some cases, the information will not be needed urgently or acted upon immediately. In most cases, as with production lines and production facilities, the information and systems are in constant use and are needed urgently and in constant action. Also, unauthorized modification or destruction of information affecting external publication of goods and services production information (e.g., web pages, electronic mail) may adversely affect public confidence in the organization. However, damage to the mission would usually be limited.
Known mitigating factors toward changing the integrity level
Unauthorized modification or destruction of information relating to production actions can result in serious disruption of production processes and loss of availability of services that can be important or even critical to organizational operations. In such cases, the integrity impact level can be high.
Availability level = High
The availability impact level is based on the specific mission and the data supporting that mission, not on the time required to reestablish access to services acquisition information. Functions and processes supported by most goods and services production information are not tolerant of delays i.e., the data supporting the functions/processes are time-critical. In most cases, disruption of access to services procurement information can be expected to have at least moderate adverse effect on organizational operations (including mission functions and public confidence in the organization), organizational assets, or individuals.
Known mitigating factors toward changing the availability level
Exceptions depend upon whether the organization has established pre-designated "backup" or "mirrored" goods and services production resources to support disaster management. Consequently, the impact level for goods and services production systems and information needed to respond to emergencies can be set to moderate.