C.2.2.3 - Regulatory creation

Regulatory Creation involves the activities of researching and drafting proposed and final regulations.

Subject to exception conditions described below, the recommended security categorization for the regulatory creation information type is as follows:

Security category

C.2.2.3 - Regulatory creation = {(confidentiality, Low), (integrity, Low), (availability, Low)}

Confidentiality Low

The level of confidentiality impact level is the effect of unauthorized disclosure of regulatory creation information on the ability of responsible agencies to research and draft proposed and final regulations. The effects of loss of confidentiality of early drafts of regulations can result in attempts by affected entities and other affected parties to influence and/or impede the regulation development process. Special Factors Affecting Confidentiality Impact Determination: Premature public release of draft regulations before internal coordination and review has been conducted can result in unnecessary criticism of the proposed regulation and even damage public confidence in the agency. In such cases, the provisional confidentiality impact level recommended for regulatory creation information is moderate. These consequences are particularly likely where the release includes unedited internal commentary and discussion. Delays can impair an agency's mission, but loss of public confidence can do serious and persistent harm to an agency's ability to effectively perform its mission. If the regulatory information is moved to the public domain, the confidentiality impact level becomes Not Applicable (NA). Recommended Confidentiality Impact Level: Because most regulatory information is intended for release to the public, the provisional confidentiality impact level recommended for regulatory creation information is low.

Integrity Low

The integrity impact level is based on the specific mission and the data supporting that mission, not on the time required to detect the modification or destruction of information. Special Factors Affecting Integrity Impact Determination: Unauthorized modification or destruction of information affecting external communications that contain regulatory information (e.g., web pages, electronic mail) may adversely affect operations or public confidence in the agency. The consequences of a reduction in public confidence will be more serious for agencies that have national defense, intelligence, or information security missions. In such cases, the impact level may be at least moderate. Recommended Integrity Impact Level: The provisional integrity impact level recommended for regulatory creation information is low.

Availability Low

The availability impact level is based on the specific mission and the data supporting that mission, not on the time required to re-establish access to the regulatory creation information. The regulatory creation process is usually tolerant of delays. Recommended Availability Impact Level: The provisional availability impact level recommended for regulatory creation information is low.