Northreach's public course-catalogue page is defaced for one hour and then restored from backup. Under FIPS 199, what is the most defensible availability impact rating for that page?

Answer

Low — a limited adverse effect; primary functions continue with noticeably reduced effectiveness

Options - A. Low — a limited adverse effect; primary functions continue with noticeably reduced effectiveness - B. Moderate — a serious adverse effect that significantly reduces effectiveness - C. High — a severe effect, because a primary mission function cannot be performed - D. High — any successful defacement of a public site is by definition severe - E. Moderate — reputational harm is always at least a serious adverse effect Why - A. Correct — an hour without a public catalogue is an inconvenience. Nobody is harmed and no primary function stops, which is exactly the low band. - B. Moderate needs a *significantly* reduced ability to perform primary functions. Enrolment, teaching and assessment all continued. - C. High requires that a primary mission function cannot be performed at all. None was affected. - D. The severity of the *event* is not the rating. The rating is the severity of the *adverse effect on the organisation, its assets or individuals*. - E. Reputational harm is real but is not automatically serious. Rate the consequence in this context, not the category of harm.

Stallings & Brown 5e ch1 §1.1; FIPS 199