FIPS 199, and why the justification is the mark

Four asset categories, three objectives, twelve cells

The assets of a computing system fall into four categories, and the standard way to reason about them is to cross each category with each objective. That gives a 4 × 3 grid of twelve cells, and each cell is a real question with a real answer.

• Hardware — servers, workstations, network equipment, removable media. Hardware is the most vulnerable class to attack and the least susceptible to automated controls, which is why physical and administrative controls carry the load here.
• Software — the applications, services and operating systems. Its most obvious threat is availability (software is easy to delete), but the hard problem is the modification that leaves a still-working program behaving differently.
• Data — files and records, including backups. Its subtlest confidentiality threat is not theft of a file but statistical inference: repeated aggregate queries that reveal an individual. Subtract the aggregate income of four people from the aggregate income of the same four plus one, and you have the fifth person's income exactly, without ever reading their record.
• Communication lines and networks — the links and the traffic on them. Messages can be destroyed, read, modified, delayed, reordered, duplicated or fabricated.

The impact scale, and what actually separates the levels

FIPS 199 defines three impact levels by the severity of the adverse effect a loss would have on operations, assets or individuals:

• Low — a limited adverse effect. The organisation can still perform its primary functions, but with noticeably reduced effectiveness; minor damage, minor financial loss, minor harm to individuals.
• Moderate — a serious adverse effect. The organisation can still perform its primary functions, but with significantly reduced effectiveness; significant damage or loss; significant harm to individuals that stops short of loss of life or serious life-threatening injury.
• High — a severe or catastrophic effect. Severe degradation or loss of one or more primary mission functions; major damage; harm involving loss of life or serious life-threatening injury.

The discriminator between low and moderate is noticeably versus significantly reduced, with the organisation still functioning in both. High is the level at which one or more primary functions cannot be performed at all. Learn it in that shape and the borderline cases stop being guesswork.

The rating is a property of the facet in context, never of the data type

This is the single most common way to lose marks on this material. "Student information" is not high impact. Ask the question three times and you get three answers:

• Confidentiality of a transcript — high. Unauthorized disclosure of a named individual's academic record is a severe harm to that individual and a reportable failure for the institution.
• Integrity of that same transcript — high, and arguably higher: a silently altered grade is acted on by employers and other institutions, and the error may be undiscoverable years later.
• Availability of that same transcript — low. A student who cannot download a transcript for four hours is inconvenienced. Nobody is harmed, and the university continues to perform its primary function.

Same data, three ratings. And the same objective takes different levels for different slices of the same asset class: the confidentiality of the public course catalogue is low, while the confidentiality of the applicant list is moderate and of a transcript is high.

Worked example — the Northreach 4 × 3 grid, four cells justified in full

Four cells, done properly. A justification names the consequence and ties it to the level's definition.

Data × confidentiality — HIGH. The store holds named transcripts and disability-adjustment records. Disclosure would cause severe harm to identified individuals and would be a reportable regulatory breach. Severe harm to individuals is the high band.

Data × integrity — HIGH. A transcript is a legal statement of attainment that third parties act on. An undetected alteration is not recoverable by re-running anything, because there is no independent copy of the truth; degrees would be conferred, or withheld, wrongly. Loss of a primary mission function — awarding credit accurately — is the high band.

Hardware × availability — MODERATE. If the primary database server fails, the backup appliance and the standby node bring the service back within the working day. Teaching continues; assessment submission is delayed for a cohort. Significantly reduced effectiveness with primary functions still performed is the moderate band. Note that the rating depends on the standby existing: remove it and this cell becomes high, which is the point — an impact rating describes a context, not a box.

Communication lines × confidentiality — MODERATE. Marks submitted from markers' homes cross the public internet. Interception would expose a course's marks before release — significant harm to a group of individuals, embarrassing and reportable, but not severe or life-threatening. Moderate.

And two cells the other way, to show the range: software × availability is MODERATE (the reporting service can be down for a day outside term end and nothing stops), while data × availability is LOW for the archived transcript store and would be HIGH for the live submission endpoint on deadline night. Two ratings for the same cell, decided entirely by which slice and which moment you name — which is why every cell must state which asset and when.

Now do it yourself. Justify four more cells for Northreach: software × integrity, hardware × confidentiality, data × confidentiality for the public course catalogue, and communication lines × availability on deadline night. Then build the whole grid from scratch for a bank's ATM network — which is the question the paper actually asks, and which you will answer below.