NIST SP 800-66r2 ipd INITIAL PUBLIC DRAFT
IMPLEMENTING THE HIPAA SECURITY RULE: A CYBERSECURITY RESOURCE GUIDE
Security Objective
Impacts or data integrity is not corrected, continued use of the contaminated system or corrupted data could result in inaccuracy, fraud, or erroneous decisions. Also, the violation of integrity may be the first step in a successful attack against system availability or confidentiality. For all of these reasons, the loss of integrity reduces the assurance of a system.
Loss of Availability
Availability refers to the requirement that data or information is accessible and usable upon demand by an authorized person or process. If a mission-critical system is unavailable to its end users, the organization’s mission may be affected. Loss of system functionality and operational effectiveness, for example, may result in the loss of productive time, thus impeding the end users’ performance of their functions in supporting the organization’s mission.
769 770
Table 5 - Examples of Adverse Impacts
Type of Impact
Impact
Harm to Operations
• Inability to perform current mission or business functions - In a sufficiently timely manner - With sufficient confidence and/or correctness - Within planned resource constraints • Inability or limited ability to restore mission or business functions in the future - In a sufficiently timely manner - With sufficient confidence and/or correctness - Within planned resource constraints • Harms (e.g., financial costs, sanctions) due to noncompliance - With applicable laws or regulations - With contractual requirements or other requirements in other binding agreements (e.g., liability) • Direct financial costs • Relational harms - Damage to trust relationships - Damage to image or reputation (and, hence, future or potential trust relationships)
Harm to Assets
• • • • • •
Damage to or loss of physical facilities Damage to or loss of information systems or networks Damage to or loss of information technology or equipment Damage to or loss of component parts or supplies Damage to or loss of information assets Loss of intellectual property
16
