Which choice below represents an application or system demonstrating a need for a high level of
confidentiality protection and controls?

A.
The mission of this system is to produce local weather forecast information that is made available
to the news media forecasters and the general public at all times. None of the information requires
protection against disclosure.

B.
Destruction of the information would require significant expenditures of time and effort to
replace. Although corrupted information would present an inconvenience to the staff, most
information, and all vital information, is backed up by either paper documentation or on disk.

C.
The application contains proprietary business information and other financial information, which
if disclosed to unauthorized sources, could cause an unfair advantage for vendors, contractors, or
individuals and could result in financial loss or adverse legal action to user organizations.

D.
Unavailability of the system could result in inability to meet payroll obligations and could cause
work stoppage and failure of user organizations to meet critical mission requirements. The system
requires 24-hour access.

Explanation:
Although elements of all of the systems described could require specific controls for confidentiality,
given the descriptions above, system b fits the definition most closely of a system requiring a very
high level of confidentiality. Answer a is an example of a system requiring high availability. Answer c
is an example of a system that requires medium integrity controls. Answer d is a system that
requires only a low level of confidentiality. Asystem may need protection for one or more of the
following reasons: Confidentiality. The system contains information that requires protection from
unauthorized disclosure. Integrity. The system contains information that must be protected from

unauthorized, unanticipated, or unintentional modification. Availability. The system contains
information or provides services which must be available on a timely basis to meet mission
requirements or to avoid substantial losses. Source: NIST Special Publication 800-18, Guide for
Developing Security Plans for Information Technology Systems