Information Security Handbook

Establishing impact

An important part of establishing the information value is assigning a qualitative score to the information that signifies the impact of lost, stolen, or destroyed information. By utilizing this score, you can establish appropriate security controls in order to properly protect your organizational information.

By utilizing the potential impact definitions from NIST Special Publication 199 as a guide we will take the information that we gathered throughout the information categorization process to assign an impact rating to the information:

 

We will use the design specification information type from the earlier example ...